theory Ipc_C

lemma setMRs_lookup_failure_ccorres:
  shows
  "ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits))
           ret__unsigned_'
     (valid_pspace'
               and (case buf of None \<Rightarrow> \<top> | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)
               and (\<lambda>_. n + length (msgFromLookupFailure lf) < msgMaxLength))
           (UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace>
                 \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>
                 \<inter> \<lbrace>map_option lookup_fault_to_H
                        (lookup_fault_lift \<acute>luf) = Some lf\<rbrace>
                 \<inter> \<lbrace>n = unat \<acute>offset\<rbrace>) hs
    (mapM (\<lambda>(x, y). setMR thread buf x y)
        (zip [n ..< msgMaxLength] (msgFromLookupFailure lf)))
    (Call setMRs_lookup_failure_'proc)" apply (rule ccorres_gen_asm)+ apply (cinit' lift: receiver_' receiveIPCBuffer_' luf_' offset_') apply csymbr apply csymbr apply (rule_tac P="valid_pspace'
                  and (case buf of None \<Rightarrow> \<top> | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)" and P'=UNIV
                in ccorres_inst) apply (clarsimp simp: msgFromLookupFailure_def lookup_fault_lift_def
                         Let_def zip_upt_Cons msgMaxLength_unfold
                         mapM_Cons mapM_Nil bind_assoc
               simp del: Collect_const
                  split: if_split_asm) apply (rule ccorres_guard_imp2) apply csymbr apply (ctac add: setMR_ccorres) apply (ccorres_rewrite) apply (simp add: ccorres_cond_iffs) apply csymbr apply (rule ccorres_return_C, simp+)[1] apply wp apply (simp del: Collect_const) apply (vcg exspec=setMR_modifies) apply (clarsimp simp: msgMaxLength_unfold Collect_const_mem) apply (simp add: lookup_fault_tag_defs) apply (rule ccorres_guard_imp2) apply csymbr apply (ctac add: setMR_ccorres) apply (simp add: ccorres_cond_iffs) apply (ccorres_rewrite) apply csymbr apply (rule ccorres_rhs_assoc)+ apply csymbr apply (ctac add: setMR_ccorres) apply (rule ccorres_return_C, simp+)[1] apply wp apply simp apply (vcg exspec=setMR_modifies) apply (wp hoare_case_option_wp) apply (simp add: Collect_const_mem) apply (vcg exspec=setMR_modifies) apply (clarsimp simp: msgMaxLength_unfold Collect_const_mem) apply (simp add: lookup_fault_missing_capability_lift_def
                      lookup_fault_lift_missing_capability) apply (simp add: lookup_fault_tag_defs) apply (rule ccorres_guard_imp2) apply csymbr apply (ctac add: setMR_ccorres) apply (simp add: ccorres_cond_iffs) apply (ccorres_rewrite) apply csymbr apply (rule ccorres_rhs_assoc)+ apply csymbr apply (ctac add: setMR_ccorres_dc) apply csymbr apply (ctac add: setMR_ccorres) apply (rule ccorres_return_C, simp+)[1] apply wp apply simp apply (vcg exspec=setMR_modifies) apply (wp hoare_case_option_wp) apply (simp add: Collect_const_mem) apply (vcg exspec=setMR_modifies) apply (wp hoare_case_option_wp) apply (simp add: Collect_const_mem) apply (vcg exspec=setMR_modifies) apply (clarsimp simp: msgMaxLength_unfold Collect_const_mem) apply (simp add: lookup_fault_depth_mismatch_lift_def
                     lookup_fault_lift_depth_mismatch) apply (simp add: lookup_fault_tag_defs) apply (rule ccorres_guard_imp2) apply csymbr apply (ctac add: setMR_ccorres) apply (simp add: ccorres_cond_iffs) apply (ccorres_rewrite) apply csymbr apply (rule ccorres_rhs_assoc)+ apply csymbr apply (ctac add: setMR_ccorres_dc) apply csymbr apply (ctac add: setMR_ccorres_dc) apply csymbr apply (ctac add: setMR_ccorres) apply (rule ccorres_return_C, simp+)[1] apply (wp hoare_case_option_wp
              | (simp add: Collect_const_mem, vcg exspec=setMR_modifies))+ apply (clarsimp simp: msgMaxLength_unfold Collect_const_mem) apply (simp add: lookup_fault_guard_mismatch_lift_def
                    lookup_fault_lift_guard_mismatch) apply (simp add: lookup_fault_tag_defs) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>_. n + length (msgFromLookupFailure lf) < msgMaxLength)) (UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some lf\<rbrace> \<inter> \<lbrace>n = unat \<acute>offset\<rbrace>) hs (mapM (\<lambda>(x, y). setMR thread buf x y) (zip [n..<msgMaxLength] (msgFromLookupFailure lf))) (Call setMRs_lookup_failure_'proc) proof (prove)
goal (1 subgoal):
 1. n + length (msgFromLookupFailure lf) < msgMaxLength \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace> \<inter> \<lbrace>map_option lookup_fault_to_H (lookup_fault_lift \<acute>luf) = Some lf\<rbrace> \<inter> \<lbrace>n = unat \<acute>offset\<rbrace>) hs (mapM (\<lambda>(x, y). setMR thread buf x y) (zip [n..<msgMaxLength] (msgFromLookupFailure lf))) (Call setMRs_lookup_failure_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>offset luf receiveIPCBuffer receiver. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q2732 offset luf receiveIPCBuffer receiver) (?Q'2732 offset luf receiveIPCBuffer receiver) (SKIP # hs) (mapM (\<lambda>(x, y). setMR thread buf x y) (zip [n..<msgMaxLength] (msgFromLookupFailure lf))) (\<acute>ret__unsigned :== CALL lookup_fault_get_lufType_'proc(luf);;
(\<acute>lufType :== \<acute>ret__unsigned;;
(lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset,\<acute>lufType + SCAST(32 signed \<rightarrow> 32) 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 3,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))))
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2732 offset luf receiveIPCBuffer receiver s \<and> s' \<in> ?Q'2732 offset luf receiveIPCBuffer receiver proof (prove)
goal (2 subgoals):
 1. \<And>offset luf receiveIPCBuffer receiver ret__unsigned. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; ret__unsigned = lookup_fault_get_tag luf\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q2732 offset luf receiveIPCBuffer receiver) (?G'2741 offset luf receiveIPCBuffer receiver ret__unsigned) (SKIP # hs) (mapM (\<lambda>(x, y). setMR thread buf x y) (zip [n..<msgMaxLength] (msgFromLookupFailure lf))) (\<acute>lufType :== ret__unsigned;;
(lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset,\<acute>lufType + SCAST(32 signed \<rightarrow> 32) 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF \<acute>lufType = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 3,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))))
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2732 offset luf receiveIPCBuffer receiver s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2741 offset luf receiveIPCBuffer receiver v} proof (prove)
goal (2 subgoals):
 1. \<And>offset luf receiveIPCBuffer receiver ret__unsigned. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; ret__unsigned = lookup_fault_get_tag luf\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q2732 offset luf receiveIPCBuffer receiver) (?G'2889 offset luf receiveIPCBuffer receiver ret__unsigned) (SKIP # hs) (mapM (\<lambda>(x, y). setMR thread buf x y) (zip [n..<msgMaxLength] (msgFromLookupFailure lf))) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset,ret__unsigned + SCAST(32 signed \<rightarrow> 32) 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 3,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2732 offset luf receiveIPCBuffer receiver s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> ?G'2889 offset luf receiveIPCBuffer receiver v}} proof (prove)
goal (2 subgoals):
 1. \<And>offset luf receiveIPCBuffer receiver ret__unsigned. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; ret__unsigned = lookup_fault_get_tag luf\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (mapM (\<lambda>(x, y). setMR thread buf x y) (zip [n..<msgMaxLength] (msgFromLookupFailure lf))) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset,ret__unsigned + SCAST(32 signed \<rightarrow> 32) 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 1,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 2,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(receiver,receiveIPCBuffer,offset + SCAST(32 signed \<rightarrow> 32) 3,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 1;
return [y]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF True THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3469 offset luf) (?Q'3469 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 1;
return [y]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF True THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3469 offset luf s \<and> s' \<in> ?Q'3469 offset luf
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3469 offset luf) (?G'3474 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 1;
return [y]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF True THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3469 offset luf s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> ?G'3474 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3485 offset luf rv) (?Q'3485 offset luf rv ret__unsigned) (SKIP # hs) (return [rv]) (\<acute>i :== ret__unsigned;;
IF True THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_missing_capability THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_invalid_root = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<lbrace>?R3485 offset luf\<rbrace> setMR thread buf (unat offset) 1 \<lbrace>?Q3485 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'3485 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3485 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3485 offset luf rv) (?Q'3485 offset luf rv ret__unsigned) (SKIP # hs) (return [rv]) (\<acute>i :== ret__unsigned;;
return_C ret__unsigned_'_update i_')
 2. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<lbrace>?R3485 offset luf\<rbrace> setMR thread buf (unat offset) 1 \<lbrace>?Q3485 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'3485 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3485 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3485 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'3485 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (return [unat (ret__unsigned && mask msgLengthBits)]) (\<acute>i :== ret__unsigned;;
return_C ret__unsigned_'_update i_')
 2. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<lbrace>?R3485 offset luf\<rbrace> setMR thread buf (unat offset) 1 \<lbrace>?Q3485 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'3485 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3485 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3485 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'3851 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (return [unat (ret__unsigned && mask msgLengthBits)]) (return_C ret__unsigned_'_update (\<lambda>s. ret__unsigned))
 2. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<lbrace>?R3485 offset luf\<rbrace> setMR thread buf (unat offset) 1 \<lbrace>?Q3485 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'3851 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3485 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<lbrace>?R3485 offset luf\<rbrace> setMR thread buf (unat offset) 1 \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> \<lbrace>[rv] \<noteq> [] \<and> last [rv] = rv\<rbrace>}}
 3. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3485 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 4. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> \<lbrace>[rv] \<noteq> [] \<and> last [rv] = rv\<rbrace>}}
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>_. True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3485 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) \<lbrace>True\<rbrace>
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>_. True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3485 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>_. True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 1\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 119; n = unat offset; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root; lf = Fault_H.lookup_failure.InvalidRoot; (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_invalid_root = 0
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3916 offset luf) (?Q'3916 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3916 offset luf s \<and> s' \<in> ?Q'3916 offset luf
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3916 offset luf) (?G'3921 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 2;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3916 offset luf s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> ?G'3921 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3932 offset luf rv) (?Q'3932 offset luf rv ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [rv, y]
od) (\<acute>i :== ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_depth_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_missing_capability = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>?Q3932 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'3932 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q3932 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'3932 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y]
od) (\<acute>i :== ret__unsigned;;
Cond {} (return_C ret__unsigned_'_update i_') (Cond UNIV (\<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Cond (if lookup_fault_missing_capability = lookup_fault_depth_mismatch then UNIV else {}) (\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Cond (if lookup_fault_missing_capability = lookup_fault_guard_mismatch then UNIV else {}) (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Guard DontReach {} SKIP)))))
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>?Q3932 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'3932 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q3932 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'3932 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y]
od) (\<acute>i :== ret__unsigned;;
(\<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>?Q3932 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'3932 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q3932 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'4385 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y]
od) (\<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>?Q3932 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'4385 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q3932 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'4385 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y]
od) (\<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>?Q3932 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'4385 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q3932 offset luf (unat (ret__unsigneda && mask msgLengthBits))) (?G'4488 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), y]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>?Q3932 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'4488 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (9 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf); rva = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q4546 offset luf rv ret__unsigneda ret__unsignedb rva) (?Q'4546 offset luf rv ret__unsigneda ret__unsignedb rva ret__unsigned) (SKIP # hs) (return [unat (ret__unsigneda && mask msgLengthBits), rva]) (return_C ret__unsigned_'_update (\<lambda>s. ret__unsigned))
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R4554 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>?Q4546 offset luf rv ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4547 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. rva = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'4546 offset luf rv ret__unsigneda ret__unsigned rva (ret__unsigned_' s)}
 4. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R4554 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4547 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 7. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 9. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R4554 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4547 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>[unat (ret__unsigneda && mask msgLengthBits), rv] \<noteq> [] \<and> last [unat (ret__unsigneda && mask msgLengthBits), rv] = unat (\<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits)\<rbrace>}
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R4554 offset luf a\<rbrace>
 4. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4547 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 5. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4547 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>[unat (ret__unsigneda && mask msgLengthBits), rv] \<noteq> [] \<and> last [unat (ret__unsigneda && mask msgLengthBits), rv] = unat (\<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits)\<rbrace>}
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and (\<lambda>a. True)\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4547 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4547 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda (lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf))) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf)) UNIV
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and (\<lambda>a. True)\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4547 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R3932 offset luf\<rbrace> setMR thread buf (unat offset) 2 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and (\<lambda>a. True)\<rbrace>
 2. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {s. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 3. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R3932 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {s. \<forall>v v'. v = lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability}}}
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3932 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (if lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6 then UNIV else {})
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'3932 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 2\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := ret__unsigned_' t\<rparr> \<in> (if lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6 then UNIV else {})}}
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability = 1 \<and> lookup_fault_missing_capability_CL.bitsLeft_CL (lookup_fault_missing_capability_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 118; n = unat offset; lookup_fault_missing_capability \<noteq> lookup_fault_invalid_root; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability; lf = Fault_H.lookup_failure.MissingCapability (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_missing_capability = 1
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q4667 offset luf) (?Q'4667 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4667 offset luf s \<and> s' \<in> ?Q'4667 offset luf
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q4667 offset luf) (?G'4672 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 3;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [y, ya, yb]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4667 offset luf s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> ?G'4672 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q4683 offset luf rv) (?Q'4683 offset luf rv ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [rv, y, ya]
od) (\<acute>i :== ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF lookup_fault_depth_mismatch = lookup_fault_guard_mismatch THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>?Q4683 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'4683 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q4683 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'4683 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya]
od) (\<acute>i :== ret__unsigned;;
Cond {} (return_C ret__unsigned_'_update i_') (Cond {} (\<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Cond UNIV (\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Cond (if lookup_fault_depth_mismatch = lookup_fault_guard_mismatch then UNIV else {}) (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Guard DontReach {} SKIP)))))
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>?Q4683 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'4683 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q4683 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'4683 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya]
od) (\<acute>i :== ret__unsigned;;
(\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>?Q4683 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'4683 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q4683 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'5205 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya]
od) (\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>?Q4683 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'5205 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q4683 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'5205 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya]
od) (\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))))
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>?Q4683 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'5205 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q4683 offset luf (unat (ret__unsigneda && mask msgLengthBits))) (?G'5371 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), y, ya]
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')))
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>?Q4683 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'5371 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5460 offset luf rv ret__unsigneda ret__unsigned rva) (?Q'5460 offset luf rv ret__unsigneda ret__unsigned rva xfdc) (SKIP # hs) (do y <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), rva, y]
od) (\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>?Q5460 offset luf rv ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'5460 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s)}
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5460 offset luf rv ret__unsigneda ret__unsignedb rva) (?G'5507 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), rva, y]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>?Q5460 offset luf rv ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'5507 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (10 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsignedc rvb ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsignedc = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf); rvb = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsignedc rvb) (?Q'5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsignedc rvb ret__unsigned) (SKIP # hs) (return [unat (ret__unsigneda && mask msgLengthBits), rva, rvb]) (return_C ret__unsigned_'_update (\<lambda>s. ret__unsigned))
 2. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5566 offset luf rv ret__unsigneda ret__unsignedb rva\<rbrace> setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>?Q5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rvb. rvb = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned rvb (ret__unsigned_' s)}
 4. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and ?R5566 offset luf rv ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5564 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 7. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 8. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 9. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 10. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (9 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5566 offset luf rv ret__unsigneda ret__unsignedb rva\<rbrace> setMR thread buf (Suc (Suc (unat offset))) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>\<lambda>rvb _. True\<rbrace>
 2. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>[unat (ret__unsigneda && mask msgLengthBits), rva, rv] \<noteq> [] \<and> last [unat (ret__unsigneda && mask msgLengthBits), rva, rv] = unat (\<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits)\<rbrace>}
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and ?R5566 offset luf rv ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5564 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 6. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 7. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 8. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 9. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); dc rva xfdc; ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5564 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>[unat (ret__unsigneda && mask msgLengthBits), rva, rv] \<noteq> [] \<and> last [unat (ret__unsigneda && mask msgLengthBits), rva, rv] = unat (\<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits)\<rbrace>}
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and (\<lambda>_. True)\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5564 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (8 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5564 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda (lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)) rva xfdc (lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf))) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf)) UNIV
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and (\<lambda>_. True)\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5564 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 8. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R5468 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and (\<lambda>_. True)\<rbrace>
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R5468 offset luf a\<rbrace>
 4. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 5. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buf of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> True)\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (6 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5461 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda (lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf))) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf)) (if lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 then UNIV else {})
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buf of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> True)\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5461 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 6. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R4683 offset luf\<rbrace> setMR thread buf (unat offset) 3 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and (\<lambda>a. valid_pspace' a \<and> (case buf of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> True)\<rbrace>
 2. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {s. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 then UNIV else {})}}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 3. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R4683 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {s. \<forall>v v'. v = lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 then UNIV else {})}}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch}}}
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (4 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4683 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (if lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6 \<and> lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 then UNIV else {})
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'4683 offset luf}
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 4. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 3\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := ret__unsigned_' t\<rparr> \<in> (if lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6 \<and> lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 then UNIV else {})}}
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch = 2 \<and> lookup_fault_depth_mismatch_CL.bitsLeft_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6 \<and> lookup_fault_depth_mismatch_CL.bitsFound_CL (lookup_fault_depth_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 117; n = unat offset; lookup_fault_depth_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_depth_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch; lf = Fault_H.lookup_failure.DepthMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)) (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)); (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_depth_mismatch = 2
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 3. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (2 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) UNIV (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q5742 offset luf) (?Q'5742 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (lvar_nondet_init i_' i_'_update;;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q5742 offset luf s \<and> s' \<in> ?Q'5742 offset luf
 3. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (3 subgoals):
 1. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q5742 offset luf) (?G'5747 offset luf) (SKIP # hs) (do y <- setMR thread buf (unat offset) 4;
ya <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
yb <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yc <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [y, ya, yb, yc]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1);;
(\<acute>i :== \<acute>ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q5742 offset luf s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> ?G'5747 offset luf}
 3. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q5758 offset luf rv) (?Q'5758 offset luf rv ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yb <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [rv, y, ya, yb]
od) (\<acute>i :== ret__unsigned;;
IF False THEN
  return_C ret__unsigned_'_update i_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF False THEN
  \<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  IF True THEN
  \<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>?Q5758 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'5758 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r \<noteq> [] \<and> last r = unat (r' && mask msgLengthBits)) ret__unsigned_' (?Q5758 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'5758 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yb <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya, yb]
od) (\<acute>i :== ret__unsigned;;
Cond {} (return_C ret__unsigned_'_update i_') (Cond {} (\<acute>ret__unsigned :== CALL lookup_fault_missing_capability_get_bitsLeft_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Cond {} (\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_depth_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Cond UNIV (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_') (Guard DontReach {} SKIP)))))
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>?Q5758 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'5758 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5758 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?Q'5758 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yb <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya, yb]
od) (\<acute>i :== ret__unsigned;;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>?Q5758 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'5758 offset luf rv (ret__unsigned_' s)}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5758 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'6349 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yb <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya, yb]
od) (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>?Q5758 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'6349 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf rv ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5758 offset luf (unat (ret__unsigned && mask msgLengthBits))) (?G'6349 offset luf (unat (ret__unsigned && mask msgLengthBits)) ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yb <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigned && mask msgLengthBits), y, ya, yb]
od) (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsLeft_'proc(luf);;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,\<acute>ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))))))
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>?Q5758 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> ?G'6349 offset luf rv (ret__unsigned_' s)}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (5 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q5758 offset luf (unat (ret__unsigneda && mask msgLengthBits))) (?G'6578 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6);
ya <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
yb <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), y, ya, yb]
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')))))
 2. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>?Q5758 offset luf\<rbrace>
 3. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'6578 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 4. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 5. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q6676 offset luf rv ret__unsigneda ret__unsigned rva) (?Q'6676 offset luf rv ret__unsigneda ret__unsigned rva xfdc) (SKIP # hs) (do y <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
ya <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), rva, y, ya]
od) (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_guardFound_'proc(luf);;
(CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,\<acute>ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))))
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6684 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>?Q6676 offset luf rv ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6677 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'6676 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s)}
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R6684 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6677 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (7 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdc; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q6676 offset luf rv ret__unsigneda ret__unsignedb rva) (?G'6724 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]);
ya <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), rva, y, ya]
od) (CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned);;
(\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')))
 2. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6684 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>?Q6676 offset luf rv ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6677 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = guardFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'6724 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 4. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R6684 offset luf a\<rbrace>
 5. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6677 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 6. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 7. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (9 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb xfdc. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb) (?Q'6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb xfdc) (SKIP # hs) (do y <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), rva, rvb, y]
od) (\<acute>ret__unsigned :== CALL lookup_fault_guard_mismatch_get_bitsFound_'proc(luf);;
(\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,\<acute>ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_'))
 2. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdc; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6814 offset luf rv ret__unsigneda ret__unsignedb rva\<rbrace> setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]) \<lbrace>?Q6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb (xfdc s)}
 4. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6684 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and ?R6814 offset luf rv ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6677 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = guardFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = lookup_fault_C.words_C luf.[Suc 0]\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6812 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R6684 offset luf a\<rbrace>
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6677 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 8. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 9. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (9 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsignedc = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc; ret__unsigned = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb) (?G'6853 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned) (SKIP # hs) (do y <- setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6);
return [unat (ret__unsigneda && mask msgLengthBits), rva, rvb, y]
od) (\<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,ret__unsigned);;
return_C ret__unsigned_'_update ret__unsigned_')
 2. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdc; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6814 offset luf rv ret__unsigneda ret__unsignedb rva\<rbrace> setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]) \<lbrace>?Q6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'6853 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 4. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6684 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and ?R6814 offset luf rv ret__unsigneda ret__unsigned a\<rbrace>
 5. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6677 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = guardFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = lookup_fault_C.words_C luf.[Suc 0]\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6812 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 6. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R6684 offset luf a\<rbrace>
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6677 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 8. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 9. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (11 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsignedd rvc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsignedc = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc; ret__unsignedd = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf); rvc = unat (ret__unsigned && mask msgLengthBits)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a \<noteq> [] \<and> last a = unat (b && mask msgLengthBits)) ret__unsigned_' (?Q6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsignedd rvc) (?Q'6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsignedd rvc ret__unsigned) (SKIP # hs) (return [unat (ret__unsigneda && mask msgLengthBits), rva, rvb, rvc]) (return_C ret__unsigned_'_update (\<lambda>s. ret__unsigned))
 2. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsignedc = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc; ret__unsigned = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6915 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb\<rbrace> setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>?Q6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned\<rbrace>
 3. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsignedc = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc; ret__unsigned = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,ret__unsigned) {s. \<forall>rvc. rvc = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> ?Q'6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned rvc (ret__unsigned_' s)}
 4. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdc; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6814 offset luf rv ret__unsigneda ret__unsignedb rva\<rbrace> setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]) \<lbrace>\<lambda>rvb. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (Suc (unat offset))) < msgMaxLength) and ?R6915 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned rvb\<rbrace>
 5. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 3) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (Suc (unat offset))))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 6. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6684 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and ?R6814 offset luf rv ret__unsigneda ret__unsigned a\<rbrace>
 7. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6677 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = guardFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = lookup_fault_C.words_C luf.[Suc 0]\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6812 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 8. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R6684 offset luf a\<rbrace>
 9. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6677 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 10. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsignedc = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc; ret__unsigned = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6915 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb\<rbrace> setMR thread buf (Suc (Suc (Suc (unat offset)))) ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6) \<lbrace>\<lambda>rvc _. True\<rbrace>
 2. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsignedc = guardFound_CL (lookup_fault_guard_mismatch_lift luf); dc rvb xfdc; ret__unsigned = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsignedc rvb xfdc ret__unsigned) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 3,ret__unsigned) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> \<lbrace>[unat (ret__unsigneda && mask msgLengthBits), rva, rvb, rv] \<noteq> [] \<and> last [unat (ret__unsigneda && mask msgLengthBits), rva, rvb, rv] = unat (\<^bsup>s\<^esup>ret__unsigned && mask msgLengthBits)\<rbrace>}
 3. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdc; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6814 offset luf rv ret__unsigneda ret__unsignedb rva\<rbrace> setMR thread buf (Suc (Suc (unat offset))) (lookup_fault_C.words_C luf.[Suc 0]) \<lbrace>\<lambda>rvb. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (Suc (unat offset))) < msgMaxLength) and ?R6915 offset luf rv ret__unsigneda ret__unsignedb rva xfdc ret__unsigned rvb\<rbrace>
 4. \<And>offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsignedb = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf); dc rva xfdca; ret__unsigned = guardFound_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6812 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 2,ret__unsigned) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 3) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (Suc (unat offset))))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6913 offset luf rv ret__unsigneda ret__unsignedb rva xfdca ret__unsigned rvb (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 5. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<lbrace>?R6684 offset luf (unat (ret__unsigneda && mask msgLengthBits))\<rbrace> setMR thread buf (Suc (unat offset)) ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6) \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. Suc (Suc (unat offset)) < msgMaxLength) and ?R6814 offset luf rv ret__unsigneda ret__unsigned a\<rbrace>
 6. \<And>offset luf rv ret__unsigneda ret__unsigned. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); rv = unat (ret__unsigneda && mask msgLengthBits); ret__unsigned = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6677 offset luf (unat (ret__unsigneda && mask msgLengthBits)) ret__unsigneda ret__unsigned) CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset + 1,ret__unsigned) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = guardFound_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 2) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (Suc (unat offset)))\<rbrace> \<inter> \<lbrace>\<acute>reg = lookup_fault_C.words_C luf.[Suc 0]\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6812 offset luf rv ret__unsigneda ret__unsigned rva (xfdc s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}
 7. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<lbrace>?R5758 offset luf\<rbrace> setMR thread buf (unat offset) 4 \<lbrace>\<lambda>a. valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) and (\<lambda>s. Suc (unat offset) < msgMaxLength) and ?R6684 offset luf a\<rbrace>
 8. \<And>offset luf. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5758 offset luf) \<acute>ret__unsigned :== CALL setMR_'proc(tcb_ptr_to_ctcb_ptr thread,option_to_ptr buf,offset,SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) {s. \<forall>rv. rv = unat (ret__unsigned_' s && mask msgLengthBits) \<longrightarrow> s \<in> {sa. i_'_update (\<lambda>_. ret__unsigned_' s) sa \<in> {sa. \<forall>v v'. v = lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. reg_'_update (\<lambda>_. v) (offset_'_update (\<lambda>_. offset + 1) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (Suc (unat offset))\<rbrace> \<inter> \<lbrace>\<acute>reg = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'6677 offset luf rv (ret__unsigned_' s) v}} \<inter> {s. lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch}}}
 9. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and ?R5758 offset luf) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> ?R'5758 offset luf}
 10. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (2 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat offset < msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (unat offset) < msgMaxLength \<and> valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (Suc (unat offset)) < msgMaxLength \<and> valid_pspace' s \<and> (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> Suc (Suc (Suc (unat offset))) < msgMaxLength \<and> True)) s \<and> s' \<in> {s. \<forall>v. i_'_update (\<lambda>_. v) s \<in> {s. reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch + 1) (offset_'_update (\<lambda>_. offset) (receiveIPCBuffer_'_update (\<lambda>_. option_to_ptr buf) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s))) \<in> UNIV \<inter> \<lbrace>\<acute>offset = word_of_nat (unat offset)\<rbrace> \<inter> \<lbrace>\<acute>reg = 4\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = option_to_ptr buf\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := ret__unsigned_' t\<rparr> \<in> (if lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 \<and> guardFound_CL (lookup_fault_guard_mismatch_lift luf) = lookup_fault_C.words_C luf.[Suc 0] \<and> lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6 then UNIV else {})}}
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (2 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch = 3 \<and> lookup_fault_guard_mismatch_CL.bitsLeft_CL (lookup_fault_guard_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 8) && mask 6 \<and> guardFound_CL (lookup_fault_guard_mismatch_lift luf) = lookup_fault_C.words_C luf.[Suc 0] \<and> lookup_fault_guard_mismatch_CL.bitsFound_CL (lookup_fault_guard_mismatch_lift luf) = (lookup_fault_C.words_C luf.[0] >> 2) && mask 6
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (2 subgoals):
 1. \<And>offset luf s s'. \<lbrakk>unat offset < 116; n = unat offset; lookup_fault_guard_mismatch \<noteq> lookup_fault_invalid_root; lookup_fault_guard_mismatch \<noteq> lookup_fault_missing_capability; lookup_fault_guard_mismatch \<noteq> lookup_fault_depth_mismatch; lookup_fault_get_tag luf = SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch; lf = Fault_H.lookup_failure.GuardMismatch (unat ((lookup_fault_C.words_C luf.[0] >> 8) && mask 6)) (lookup_fault_C.words_C luf.[Suc 0]) (unat ((lookup_fault_C.words_C luf.[0] >> 2) && mask 6)); (s, s') \<in> rf_sr; valid_pspace' s; (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) lookup_fault_guard_mismatch = 3
 2. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal (1 subgoal):
 1. \<And>offset luf receiveIPCBuffer receiver s s'. \<lbrakk>n + length (msgFromLookupFailure lf) < msgMaxLength; n = unat offset; \<exists>z. lookup_fault_lift luf = Some z \<and> lookup_fault_to_H z = lf; receiveIPCBuffer = option_to_ptr buf; receiver = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and (case buf of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s \<and> s' \<in> {s. \<forall>v. v = lookup_fault_get_tag (lookup_fault_' (lookup_fault_'_update (\<lambda>_. luf) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. lufType_'_update (\<lambda>_. v) s \<in> UNIV}} proof (prove)
goal:
No subgoals!