theory Interrupt_C

lemma Arch_decodeIRQControlInvocation_ccorres:
  notes if_cong[cong]
  shows
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread)
              and sch_act_simple and ct_active'
              and (excaps_in_mem extraCaps o ctes_of)
              and cte_wp_at' (\<lambda>cte. cteCap cte = IRQControlCap) slot
              and (\<lambda>s. \<forall>v \<in> set extraCaps. s \<turnstile>' fst v)
              and sysargs_rel args buffer)
       (UNIV
            \<inter> {s. invLabel_' s = label} \<inter> {s. srcSlot_' s = cte_Ptr slot}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (Arch.decodeIRQControlInvocation label args slot (map fst extraCaps)
        >>= invocationCatch thread isBlocking isCall (InvokeIRQControl o ArchIRQControl))
     (Call Arch_decodeIRQControlInvocation_'proc)" apply (cinit' lift: invLabel_' srcSlot_' length___unsigned_long_' current_extra_caps_' buffer_') apply (simp add: ARM_H.decodeIRQControlInvocation_def invocation_eq_use_types
               del: Collect_const
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule ccorres_Cond_rhs) apply (simp add: list_case_If2
                del: Collect_const cong: call_ignore_cong) apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (rule ccorres_Cond_rhs_Seq) apply (simp add: word_less_nat_alt throwError_bind invocationCatch_def) apply (rule ccorres_cond_true_seq) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (simp add: interpret_excaps_test_null excaps_map_def throwError_bind
                      invocationCatch_def) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: interpret_excaps_test_null excaps_map_def
                     word_less_nat_alt Let_def
                del: Collect_const cong: call_ignore_cong) apply (rule ccorres_add_return) apply (ctac add: getSyscallArg_ccorres_foo[where args=args and n=0 and buffer=buffer]) apply csymbr apply (rule ccorres_add_return) apply (ctac add: getSyscallArg_ccorres_foo[where args=args and n=1 and buffer=buffer]) apply (rule ccorres_add_return) apply csymbr apply (ctac add: getSyscallArg_ccorres_foo[where args=args and n=2 and buffer=buffer]) apply (rule ccorres_add_return) apply (ctac add: getSyscallArg_ccorres_foo[where args=args and n=3 and buffer=buffer]) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply ctac apply (rule ccorres_assert2) apply (simp add: rangeCheck_def unlessE_def ARM.minIRQ_def
                               ucast_nat_def word_le_nat_alt[symmetric]
                               linorder_not_le[symmetric] Platform_maxIRQ
                               length_ineq_not_Nil hd_conv_nth cast_simps
                               maxIRQ_ucast_scast
                          del: Collect_const cong: call_ignore_cong) apply (simp add: split_def invocationCatch_use_injection_handler
                               injection_handler_bindE bindE_assoc
                          del: Collect_const) apply (ctac add: ccorres_injection_handler_csum1[OF Arch_checkIRQ_ccorres]) apply (simp add: injection_liftE) apply (simp add: liftE_bindE bind_assoc del: Collect_const) apply (ctac add: isIRQActive_ccorres) apply (simp add: from_bool_0 del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: throwError_bind invocationCatch_def whenE_def
                                     injection_handler_throwError) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: split_def invocationCatch_use_injection_handler
                                    injection_handler_bindE bindE_assoc whenE_def
                                    injection_handler_returnOk
                               del: Collect_const) apply (ctac add: ccorres_injection_handler_csum1
                                    [OF lookupTargetSlot_ccorres, unfolded lookupTargetSlot_def]) apply (simp add: Collect_False split_def del: Collect_const) apply csymbr apply (ctac add: ccorres_injection_handler_csum1
                                       [OF ensureEmptySlot_ccorres]) apply (simp add: injection_handler_returnOk ccorres_invocationCatch_Inr
                                       performInvocation_def bindE_assoc) using [[goals_limit=2]] apply (ctac add: setThreadState_ccorres) apply (ctac(no_vcg) add: Arch_invokeIRQControl_ccorres) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply (wp sts_invs_minor')+ apply (simp add: Collect_const_mem) apply (vcg exspec=setThreadState_modifies) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_return_C_errorE, simp+)[1] apply vcg apply simp apply (wp injection_wp_E [OF refl]) apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=ensureEmptySlot_modifies) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_return_C_errorE, simp+)[1] apply vcg apply simp apply (wp injection_wp_E[OF refl] hoare_drop_imps) apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=lookupTargetSlot_modifies) apply simp apply (wp hoare_drop_imps isIRQActive_inv) apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=isIRQActive_modifies) apply simp apply (rule ccorres_split_throws) apply (rule ccorres_return_C_errorE, simp+)[1] apply vcg apply simp apply (wp injection_wp_E[OF refl] checkIRQ_ret_good) apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=Arch_checkIRQ_modifies) apply (wp hoare_vcg_const_imp_lift |wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem all_ex_eq_helper) apply vcg apply wp apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=getSyscallArg_modifies) apply simp apply wp apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=getSyscallArg_modifies) apply simp apply wp apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=getSyscallArg_modifies) apply simp apply wp apply (simp add: Collect_const_mem all_ex_eq_helper) apply (vcg exspec=getSyscallArg_modifies) apply (clarsimp simp: decodeIRQ_arch_helper') apply (simp add: throwError_bind invocationCatch_def) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (clarsimp simp: interpret_excaps_test_null excaps_map_def
                        Collect_const_mem word_sless_def word_sle_def
                        ThreadState_Restart_def unat_of_nat mask_def) apply (rule conjI) apply (simp add: Kernel_C.maxIRQ_def word_le_nat_alt ucast_nat_def unat_ucast) apply (cut_tac unat_lt2p[where x="args ! 3"]) apply clarsimp apply (clarsimp simp: sysargs_rel_to_n word_less_nat_alt unat_ucast) apply (auto,
          auto simp: ct_in_state'_def neq_Nil_conv word_bits_def
                     excaps_in_mem_def slotcap_in_mem_def
                     cte_wp_at_ctes_of numeral_eqs[symmetric]
                     valid_tcb_state'_def
               elim!: pred_tcb'_weakenE
               dest!: st_tcb_at_idle_thread' interpret_excaps_eq)[1] apply (clarsimp simp: neq_Nil_conv numeral_eqs[symmetric] word_sle_def word_sless_def) apply (drule interpret_excaps_eq[rule_format, where n=0], simp) apply (clarsimp simp: mask_def[where n=4] "StrictC'_thread_state_defs"
                        rf_sr_ksCurThread ccap_rights_relation_def
                        rightsFromWord_wordFromRights) apply (simp cong: conj_cong) apply (clarsimp simp: Kernel_C.maxIRQ_def word_le_nat_alt
                        ucast_nat_def ucast_ucast_mask mask_eq_ucast_eq unat_ucast_mask
                        less_mask_eq[unfolded word_less_nat_alt]) apply (cases "args ! Suc 0 = 0"; clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>\<acute>invLabel = label\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (Arch.decodeIRQControlInvocation label args slot (map fst extraCaps) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (Call Arch_decodeIRQControlInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4093 buffera current_extra_caps length___unsigned_long srcSlot invLabel) (?Q'4093 buffera current_extra_caps length___unsigned_long srcSlot invLabel) [SKIP] (Arch.decodeIRQControlInvocation label args slot (map fst extraCaps) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (IF invLabel = SCAST(32 signed \<rightarrow> 32) ARMIRQIssueIRQHandlerTrigger THEN
  \<acute>ret__int :== (if length___unsigned_long < 4 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>irq_w :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
\<acute>irq :== \<acute>irq_w;;
\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
\<acute>index :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
\<acute>depth :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 3,buffera);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>irq,\<acute>destSlot,srcSlot,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q4093 buffera current_extra_caps length___unsigned_long srcSlot invLabel s \<and> s' \<in> ?Q'4093 buffera current_extra_caps length___unsigned_long srcSlot invLabel proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4093 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?Q'4093 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (IF invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler THEN
  \<acute>ret__int :== (if length___unsigned_long < 4 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
\<acute>irq :== \<acute>irq_w;;
\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
\<acute>status :== CALL Arch_checkIRQ_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
ELSE
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q4093 buffera current_extra_caps length___unsigned_long srcSlot invLabel s \<and> s' \<in> ?Q'4093 buffera current_extra_caps length___unsigned_long srcSlot invLabel proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4109 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4112 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if length___unsigned_long < 4 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
\<acute>irq :== \<acute>irq_w;;
\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
\<acute>status :== CALL Arch_checkIRQ_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?Q4109 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?S4112 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4109 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4112 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if length___unsigned_long < 4 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
\<acute>irq :== \<acute>irq_w;;
\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
\<acute>status :== CALL Arch_checkIRQ_'proc();;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?Q4109 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?S4112 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4109 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4112 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if length___unsigned_long < 4 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?Q4109 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?S4112 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4109 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?G'4219 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (IF (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?Q4109 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> ?G'4219 buffera current_extra_caps length___unsigned_long srcSlot invLabel}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4369 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4372 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4368 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4370 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q4369 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4368 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S4372 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4370 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; length args < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4369 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4372 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4368 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4370 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q4369 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4368 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S4372 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4370 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; length args < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4369 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?R'4392 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4368 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4370 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q4369 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4368 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?R'4392 buffera current_extra_caps length___unsigned_long srcSlot invLabel \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4370 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; length args < 4\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4368 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4370 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4368 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4370 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4368 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4370 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__int :== (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4368 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4370 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4368 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?G'4406 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (IF (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4368 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'4406 buffera current_extra_caps length___unsigned_long srcSlot invLabel})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0; (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4986 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4985 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4987 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (SKIP;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q4986 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4985 buffera current_extra_caps length___unsigned_long srcSlot invLabel s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S4989 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4987 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4986 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?S4989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc();;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc();;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4985 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4987 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (SKIP;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q4986 buffera current_extra_caps length___unsigned_long srcSlot invLabel s) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4985 buffera current_extra_caps length___unsigned_long srcSlot invLabel s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S4989 buffera current_extra_caps length___unsigned_long srcSlot invLabel) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4987 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel err' ft'. \<lbrakk>interpret_excaps extraCaps' = []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4985 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4987 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (SKIP;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4985 buffera current_extra_caps length___unsigned_long srcSlot invLabel s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4987 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4985 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4987 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc 0 then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc 0) then throwError Fault_H.syscall_error.TruncatedMessage else if length args \<le> Suc (Suc (Suc 0)) then throwError Fault_H.syscall_error.TruncatedMessage else if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (SKIP;;
(\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4985 buffera current_extra_caps length___unsigned_long srcSlot invLabel s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4987 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4985 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4987 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4985 buffera current_extra_caps length___unsigned_long srcSlot invLabel s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4987 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4985 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4987 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] (do _ <- return ();
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>irq :== \<acute>irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(\<acute>irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R4985 buffera current_extra_caps length___unsigned_long srcSlot invLabel s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T4987 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv) (?Q'5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>irq :== irq_w;;
(\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(\<acute>irq);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,\<acute>irq,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>?Q5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> ?Q'5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv) (?G'5561 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>?Q5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> ?G'5561 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv) (?G'5561 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) [SKIP] (do _ <- return ();
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>trigger :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>?Q5016 buffera current_extra_caps length___unsigned_long srcSlot invLabel\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> ?G'5561 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva) (?Q'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>trigger :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>?Q6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> ?Q'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva) (?Q'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) [SKIP] (do _ <- return ();
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>trigger :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,\<acute>trigger);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>?Q6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> ?Q'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva) (?G'6303 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) [SKIP] (do _ <- return ();
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,\<acute>index,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>?Q6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> ?G'6303 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb) (?Q'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,indexa,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>?Q6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> ?Q'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb) (?Q'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) [SKIP] (do _ <- return ();
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,indexa,\<acute>depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>?Q6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> ?Q'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R5024 buffera current_extra_caps length___unsigned_long srcSlot invLabel) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'5017 buffera current_extra_caps length___unsigned_long srcSlot invLabel)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc) (?Q'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,indexa,depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>?Q7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> ?Q'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc (depth_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P7575 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc) (?Q'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,indexa,depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P7575 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> ?Q'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc (depth_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A7578 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc) (?C'7577 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(\<acute>cnodeCap,indexa,depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A7578 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> ?C'7577 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv (irq_w_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3; ccap_relation rvd cnodeCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) (?Q'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd cnodeCap) [SKIP] (do _ <- assert (rvd = fst (extraCaps ! 0));
(if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)
od) (\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,index,depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> ?Q'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3; ccap_relation rvd cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7964 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) (?G'7962 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd cnodeCap) [SKIP] ((if args = [] then throwError Fault_H.syscall_error.TruncatedMessage else doE y <- checkIRQ (hd args);
irqActive <- liftE (isIRQActive (toEnum (unat (hd args))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (hd (map fst extraCaps)) (hd (drop (Suc (Suc 0)) args)) (unat (hd (drop (Suc (Suc (Suc 0))) args)));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (hd args))) destSlot slot (hd (drop (Suc 0) args) \<noteq> 0))
odE) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,index,depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ?G7964 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd s\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'7962 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7964 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))) (?G'7962 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) [SKIP] (doE y <- checkIRQ (args ! 0);
irqActive <- liftE (isIRQActive (toEnum (unat (args ! 0))));
y <- whenE irqActive (throwError Fault_H.syscall_error.RevokeFirst);
destSlot <- lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))));
y <- ensureEmptySlot destSlot;
returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) destSlot slot (args ! Suc 0 \<noteq> 0))
odE >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>status :== CALL Arch_checkIRQ_'proc(irq_w);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(irq_w);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,index,depth);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,irq_w,if ret__unsigned_long \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ?G7964 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd s\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'7962 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G7964 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))) (?G'7962 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) [SKIP] (doE x <- injection_handler Inl (checkIRQ (args ! 0));
x <- injection_handler Inl (liftE (isIRQActive (toEnum (unat (args ! 0)))));
x <- injection_handler Inl (whenE x (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (\<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ?G7964 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd s\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'7962 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva (ret__unsigned_long_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv) (?Q'7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv status) [SKIP] (doE x <- injection_handler Inl (liftE (isIRQActive (toEnum (unat (args ! 0)))));
x <- injection_handler Inl (whenE x (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. status)
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>?Q7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> ?Q'7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()) (?Q'7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (doE x <- liftE (isIRQActive (toEnum (unat (args ! 0))));
x <- injection_handler Inl (whenE x (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>?Q7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> ?Q'7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()) (?Q'7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do x <- isIRQActive (toEnum (unat (args ! 0)));
doE x <- injection_handler Inl (whenE x (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE
od) (\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>?Q7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> ?Q'7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb (index_' s)}
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8285 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv) (?Q'8285 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>?Q8285 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> ?Q'8285 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8285 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?Q'8285 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (from_bool rv)) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (IF rv THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>?Q8285 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> ?Q'8285 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s)}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv; rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8591 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?S8594 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (from_bool rv)) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8590 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8592 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (from_bool rv)) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (SKIP;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> ?Q8591 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b) \<and> (\<not> a \<longrightarrow> ?R8590 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> ?S8594 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s)) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T8592 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8591 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) True) (?S8594 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) True (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (throwError (Inl Fault_H.syscall_error.RevokeFirst)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8590 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8592 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (from_bool rv)) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (SKIP;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> ?Q8591 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b) \<and> (\<not> a \<longrightarrow> ?R8590 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> ?S8594 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s)) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T8592 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; rv\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst) err') ft' = Some Fault_H.syscall_error.RevokeFirst
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8590 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8592 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (from_bool rv)) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (SKIP;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R8590 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b)\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T8592 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool rv; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8590 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv) (?T8592 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) rv (from_bool rv)) [SKIP] (doE x <- injection_handler Inl (whenE rv (throwError Fault_H.syscall_error.RevokeFirst));
x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
injection_handler Inl (returnOk (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0))) >>=E (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) \<circ> Inr)
odE) (SKIP;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R8590 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T8592 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8590 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False) (?T8592 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (doE x <- injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0)))));
xa <- injection_handler Inl (ensureEmptySlot x);
invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) (Inr (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) x slot (args ! Suc 0 \<noteq> 0)))
odE) (\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R8590 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a b)\<rbrace>
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T8592 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cnodeCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> ?R'7982 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth rvd (cnodeCap_' s)}}
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc (depth_' s) \<inter> \<lbrace>True\<rbrace>}
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva) (?Q'8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C) [SKIP] (doE x <- injection_handler Inl (ensureEmptySlot rva);
invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) (Inr (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)))
odE) (IF lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C)
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>?Q8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> ?Q'8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva (lu_ret___struct_lookupSlot_ret_C_' s))) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err (lu_ret___struct_lookupSlot_ret_C_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and ?R8616 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a) b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> ?R'8609 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8608 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva) (?Q'8608 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) [SKIP] (doE x <- injection_handler Inl (ensureEmptySlot rva);
invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) (Inr (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)))
odE) (\<acute>destSlot :== cte_Ptr rva;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>?Q8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> ?Q'8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva (lu_ret___struct_lookupSlot_ret_C_' s))) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err (lu_ret___struct_lookupSlot_ret_C_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and ?R8616 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a) b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> ?R'8609 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8608 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva) (?G'8866 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) [SKIP] (doE x <- injection_handler Inl (ensureEmptySlot rva);
invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) (Inr (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)))
odE) (\<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>?Q8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. cte_Ptr rva) sa \<in> ?G'8866 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva (lu_ret___struct_lookupSlot_ret_C_' s)})) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err (lu_ret___struct_lookupSlot_ret_C_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and ?R8616 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a) b)\<rbrace>
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> ?R'8609 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and ?R8293 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap a\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> ?R'8286 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err (status_' s) (errstate s)))}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and ?R7989 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth rvd) s\<rbrace>
A total of 21 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C rvb status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb (undefined status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C rvb) (?Q'9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C rvb status) [SKIP] (invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl) (Inr (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)))) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. status)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>?Q9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C\<rbrace>, \<lbrace>?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9040 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) \<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (undefined (status_' s)) \<longrightarrow> s \<in> ?Q'9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C rvb (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err (status_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R9047 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long a\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. cte_Ptr rva) sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr rva) s \<in> UNIV \<inter> \<lbrace>rva = ptr_val \<acute>slot\<rbrace>} \<inter> ?R'9040 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva (lu_ret___struct_lookupSlot_ret_C_' s)})) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err (lu_ret___struct_lookupSlot_ret_C_' s) (errstate s)))}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and ?R8616 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a) b)\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> ?R'8609 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C ()) (?Q'9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE x <- global.performIRQControl (irqcontrol_invocation.ArchIRQControl (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 3. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>?Q9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C\<rbrace>, \<lbrace>?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C\<rbrace>
 4. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9040 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) \<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. dc rvb (undefined (status_' s)) \<longrightarrow> s \<in> ?Q'9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C rvb (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err (status_' s) (errstate s)))}
 5. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 6. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R9047 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long a\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
 7. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. cte_Ptr rva) sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr rva) s \<in> UNIV \<inter> \<lbrace>rva = ptr_val \<acute>slot\<rbrace>} \<inter> ?R'9040 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva (lu_ret___struct_lookupSlot_ret_C_' s)})) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err (lu_ret___struct_lookupSlot_ret_C_' s) (errstate s)))}
 8. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and ?R8616 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status a) b)\<rbrace>
 9. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> ?R'8609 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status rv (ret__unsigned_long_' s))}}
 10. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C ()) (?Q'9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE x <- global.performIRQControl (irqcontrol_invocation.ArchIRQControl (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9207 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb) (?Q'9207 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc) [SKIP] (doE x <- global.performIRQControl (irqcontrol_invocation.ArchIRQControl (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0)));
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
odE) (\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9215 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q9207 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status\<rbrace>
A total of 26 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc rvc ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longb = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc; dc rvc (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc rvc) (?Q'9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc rvc ret__unsigned_long) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longb = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err) (?Q''9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc rvc ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longb = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc; dc rvc (K () ret__unsigned_long); id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc rvc) (?Q'9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc rvc ret__unsigned_long) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longb = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err) (?Q''9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err rv' ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longb = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv') ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err) (?Q''9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_longb rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc err rv' ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R9269 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb\<rbrace> global.performIRQControl (irqcontrol_invocation.ArchIRQControl (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0))) \<lbrace>\<lambda>rvc _. True\<rbrace>, \<lbrace>?QE9267 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc\<rbrace>
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R9269 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status rvb\<rbrace> global.performIRQControl (irqcontrol_invocation.ArchIRQControl (local.irqcontrol_invocation.IssueIRQHandler (toEnum (unat (args ! 0))) rva slot (args ! Suc 0 \<noteq> 0))) \<lbrace>\<lambda>rvc _. True\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9215 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C ()\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>_. UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) and ?R9269 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9208 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. trigger_'_update (\<lambda>x. if args ! Suc 0 \<noteq> 0 then 1 else 0) (irq_'_update (\<lambda>x. args ! 0) (controlSlot_'_update (\<lambda>_. cte_Ptr slot) (handlerSlot_'_update (\<lambda>_. cte_Ptr rva) s))) \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0)))\<rbrace> \<inter> \<lbrace>\<acute>handlerSlot = cte_Ptr rva\<rbrace> \<inter> \<lbrace>\<acute>controlSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>trigger = from_bool (args ! Suc 0 \<noteq> 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9208 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (if args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0) then UNIV else {})
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<and> True \<and> True)\<rbrace>, \<lbrace>?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C\<rbrace>
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C err) (?Q''9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv');;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(cte_Ptr rva,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<and> True \<and> True)\<rbrace>, \<lbrace>?QE9039 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE9039 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C err) (?P'9411 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9410 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C err rv' status) return_C ret__unsigned_long_'_update (\<lambda>s. rv') {},UNIV
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap statusa rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; statusa = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9410 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C err rv' status) return_C ret__unsigned_long_'_update (\<lambda>s. rv') {},UNIV
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<and> True \<and> True)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9040 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) \<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (undefined (status_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_longa \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_longa \<noteq> 0) then UNIV else {})})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (status_' s) \<noteq> status \<and> intr_and_se_rel err (id (status_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R9047 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva\<rbrace> injection_handler Inl (ensureEmptySlot rva) \<lbrace>\<lambda>a b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9040 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) \<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (undefined (status_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_longa \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_longa \<noteq> 0) then UNIV else {})})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (status_' s) \<noteq> status \<and> intr_and_se_rel err (id (status_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9040 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) \<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (undefined (status_' s)) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_longa \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_longa \<noteq> 0) then UNIV else {})})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (status_' s) \<noteq> status \<and> intr_and_se_rel err (id (status_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long rva lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.slot_C lu_ret___struct_lookupSlot_ret_C = cte_Ptr rva \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits; lookupSlot_ret_C.status_C lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9040 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) rva lu_ret___struct_lookupSlot_ret_C) \<acute>status :== CALL ensureEmptySlot_'proc(cte_Ptr rva) \<lbrace>\<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err) (?Q''8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (IF lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv')
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. True \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) a b \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ))\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) err) (?Q''8608 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv');;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C rv';;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. True \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) a b \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ))\<rbrace>, \<lbrace>?QE8608 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE8608 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) err) (?P'9479 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) err rv' lu_ret___struct_lookupSlot_ret_C) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv'))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9478 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) err rv' lu_ret___struct_lookupSlot_ret_C) return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv') {},UNIV
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long err rv' lu_ret___struct_lookupSlot_ret_C. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (lookupSlot_ret_C.status_C rv') lu_ret___struct_lookupSlot_ret_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9478 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false) err rv' lu_ret___struct_lookupSlot_ret_C) return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C rv') {},UNIV
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. True \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) a b \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>b. True \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) a b \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ))\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rv \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr rv) s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr rv) s \<in> UNIV \<inter> \<lbrace>rv = ptr_val \<acute>slot\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = status \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_longa \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_longa \<noteq> 0)\<rbrace>})) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) \<noteq> status \<and> intr_and_se_rel err (id (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<lbrace>?R8616 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False\<rbrace> injection_handler Inl (lookupSlotForCNodeOp False (fst (extraCaps ! 0)) (args ! Suc (Suc 0)) (unat (args ! Suc (Suc (Suc 0))))) \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) a b \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rv \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr rv) s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr rv) s \<in> UNIV \<inter> \<lbrace>rv = ptr_val \<acute>slot\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = status \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_longa \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_longa \<noteq> 0)\<rbrace>})) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) \<noteq> status \<and> intr_and_se_rel err (id (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) {s. (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_ret_C.slot_C (lu_ret___struct_lookupSlot_ret_C_' s) = cte_Ptr rv \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr rv) s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr rv) s \<in> UNIV \<inter> \<lbrace>rv = ptr_val \<acute>slot\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = status \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_longa \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_longa \<noteq> 0)\<rbrace>})) \<and> (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s)) \<noteq> status \<and> intr_and_se_rel err (id (lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)) b)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_longa index depth rvd cnodeCap status rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_longa = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> rv\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8609 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) False (SCAST(32 signed \<rightarrow> 32) false)) \<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3) \<lbrace>lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)) b)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits) and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)) b)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {s. (rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<longrightarrow> s \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> \<lbrace>\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = status \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)\<rbrace>)}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R8293 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap ()\<rbrace> isIRQActive (toEnum (unat (args ! 0))) \<lbrace>\<lambda>a b. \<not> a \<longrightarrow> invs' b \<and> valid_cap' (fst (extraCaps ! 0)) b \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> st_tcb_at' runnable' thread b \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {s. (rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<longrightarrow> s \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> \<lbrace>\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = status \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)\<rbrace>)}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) {s. \<forall>rv. ret__unsigned_long_' s = from_bool rv \<longrightarrow> s \<in> {s. (rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> rv \<longrightarrow> s \<in> {s. depth_'_update (\<lambda>x. depth) (capptr_'_update (\<lambda>_. index) (root_'_update (\<lambda>_. cnodeCap) s)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = args ! Suc (Suc 0)\<rbrace> \<inter> \<lbrace>ccap_relation rvd \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (unat (args ! Suc (Suc (Suc 0))))\<rbrace>} \<inter> \<lbrace>\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = status \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)\<rbrace>)}}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8286 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) \<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0) \<lbrace>\<forall>rv. \<acute>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (id rv') status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err) (?Q''7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and (\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap err) (?Q''7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv');;
(\<acute>ret__unsigned_long :== CALL isIRQActive_'proc(args ! 0);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_RevokeFirst));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>lu_ret___struct_lookupSlot_ret_C :== CALL lookupTargetSlot_'proc(cnodeCap,args ! 2,args ! 3);;
(IF lookupSlot_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_ret_C.status_C (lu_ret___struct_lookupSlot_ret_C_' s))
FI;;
(\<acute>destSlot :== lookupSlot_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_ret_C;;
(\<acute>status :== CALL ensureEmptySlot_'proc(\<acute>destSlot);;
(IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned_long :== CALL Arch_invokeIRQControl_'proc(\<acute>destSlot,cte_Ptr slot,args ! 0,if args ! Suc 0 \<noteq> 0 then 1 else 0);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and (\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)\<rbrace>, \<lbrace>?QE7981 buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE7981 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap err) (?P'9641 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap err rv' status) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9640 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap err rv' status) return_C ret__unsigned_long_'_update (\<lambda>s. rv') {},UNIV
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap err rv' status. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0); rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a rv' status\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9640 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cnodeCap err rv' status) return_C ret__unsigned_long_'_update (\<lambda>s. rv') {},UNIV
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and (\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a. (\<lambda>a. toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ) and (\<lambda>a. invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> \<lbrace>\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> index = args ! Suc (Suc 0) \<and> depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = \<^bsup>s\<^esup>status \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0))\<rbrace>)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (status_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R7989 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> injection_handler Inl (checkIRQ (args ! 0)) \<lbrace>\<lambda>a b. toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' b \<and> valid_cap' (fst (extraCaps ! 0)) b \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> st_tcb_at' runnable' thread b \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> \<lbrace>\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> index = args ! Suc (Suc 0) \<and> depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = \<^bsup>s\<^esup>status \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0))\<rbrace>)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (status_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w))\<rbrace>} \<inter> \<lbrace>\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> index = args ! Suc (Suc 0) \<and> depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = \<^bsup>s\<^esup>status \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0))\<rbrace>)) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (status_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (status_' s)) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long index depth rvd cnodeCap. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; 4 \<le> length args; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; index = args ! 2; depth = args ! 3; ccap_relation (fst (extraCaps ! 0)) cnodeCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7982 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cnodeCap) \<acute>status :== CALL Arch_checkIRQ_'proc(args ! 0) \<lbrace>\<acute>status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True)) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; index = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R7586 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb index rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_cap' rvd a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True)) s\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cnodeCap_' s) \<longrightarrow> s \<in> {s. rv = fst (extraCaps ! 0) \<longrightarrow> s \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> indexa = args ! Suc (Suc 0) \<and> depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)))\<rbrace>}}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa rvc depth) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cnodeCap_' s) \<longrightarrow> s \<in> {s. rv = fst (extraCaps ! 0) \<longrightarrow> s \<in> {s. irq_w_'_update (\<lambda>x. irq_w) s \<in> UNIV \<inter> \<lbrace>irq_w = \<acute>irq_w\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> indexa = args ! Suc (Suc 0) \<and> depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)))\<rbrace>}}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>s. True \<and> True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' s \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long indexa depth. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; indexa = args ! 2; depth = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7583 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3)) \<acute>cnodeCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) \<lbrace>ccap_relation (fst (extraCaps ! 0)) \<acute>cnodeCap \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>s. True \<and> True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' s \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R7177 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>s. True \<and> True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' s \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rv. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> indexa = args ! Suc (Suc 0) \<and> \<^bsup>s\<^esup>depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
A total of 10 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long rvb indexa) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rv. depth_' s = args ! 3 \<longrightarrow> s \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> indexa = args ! Suc (Suc 0) \<and> \<^bsup>s\<^esup>depth = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0)))\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>s. True \<and> True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' s \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))\<rbrace>
A total of 9 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long indexa. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0; indexa = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7175 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0) () (args ! 2)) \<acute>depth :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) \<lbrace>\<acute>depth = args ! 3 \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>s. True \<and> True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' s \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))\<rbrace>
A total of 9 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>s. True \<and> True \<and> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' s \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rv. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 3 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> \<^bsup>s\<^esup>index = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0))))\<rbrace>}
A total of 8 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6749 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) ()\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rv. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 3 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> \<^bsup>s\<^esup>index = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0))))\<rbrace>}
A total of 8 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w rva ret__unsigned_long) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rv. index_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 3 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> \<^bsup>s\<^esup>index = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (ret__unsigned_long \<noteq> 0))))\<rbrace>}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (sysargs_rel args buffer and sysargs_rel_n args buffer 3 and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)))\<rbrace>
A total of 7 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0; ret__unsigned_long = args ! Suc 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6747 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0) () (args ! Suc 0)) \<acute>index :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) \<lbrace>\<acute>index = args ! 2 \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 3) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (sysargs_rel args buffer and sysargs_rel_n args buffer 3 and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)))\<rbrace>
A total of 7 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (sysargs_rel args buffer and sysargs_rel_n args buffer 3 and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat irq_w) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rv. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 2 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if \<^bsup>s\<^esup>ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (\<^bsup>s\<^esup>ret__unsigned_long \<noteq> 0))))\<rbrace>}}
A total of 6 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R6050 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label ()\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rv. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 2 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if \<^bsup>s\<^esup>ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (\<^bsup>s\<^esup>ret__unsigned_long \<noteq> 0))))\<rbrace>}}
A total of 6 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 buffera current_extra_caps length___unsigned_long srcSlot invLabel rv irq_w) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rv. ret__unsigned_long_' s = args ! 1 \<longrightarrow> s \<in> {sa. trigger_'_update (\<lambda>_. if ret__unsigned_long_' s \<noteq> 0 then 1 else 0) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 2 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat irq_w)) \<and> (if \<^bsup>s\<^esup>ret__unsigned_long \<noteq> 0 then 1 else 0) = from_bool (\<^bsup>s\<^esup>ret__unsigned_long \<noteq> 0))))\<rbrace>}}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and (sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)))\<rbrace>
A total of 5 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel irq_w. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []; irq_w = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6048 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label () (args ! 0)) \<acute>ret__unsigned_long :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) \<lbrace>\<acute>ret__unsigned_long = args ! Suc 0 \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 2) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and (sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)))\<rbrace>
A total of 5 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and (sysargs_rel args buffer and sysargs_rel_n args buffer 2 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! Suc 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> \<^bsup>s\<^esup>irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> \<^bsup>s\<^esup>irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat \<^bsup>s\<^esup>irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> \<^bsup>s\<^esup>irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat \<^bsup>s\<^esup>irq_w)) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>}}
A total of 4 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R5024 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label\<rbrace> return () \<lbrace>\<lambda>a b. sysargs_rel args buffer b \<and> sysargs_rel_n args buffer (Suc 0) b \<and> sysargs_rel args buffer b \<and> sysargs_rel_n args buffer 2 b \<and> sysargs_rel args buffer b \<and> sysargs_rel_n args buffer 3 b \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) b \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' b \<and> valid_objs' b \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> st_tcb_at' runnable' thread b \<and> sch_act_simple b \<and> invs' b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) b) \<and> excaps_in_mem extraCaps (ctes_of b)\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! Suc 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> \<^bsup>s\<^esup>irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> \<^bsup>s\<^esup>irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat \<^bsup>s\<^esup>irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> \<^bsup>s\<^esup>irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat \<^bsup>s\<^esup>irq_w)) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>}}
A total of 4 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. irq_w_' s = args ! 0 \<longrightarrow> s \<in> {sa. irq_'_update (\<lambda>_. irq_w_' s) sa \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! Suc 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> \<^bsup>s\<^esup>irq_w \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> \<^bsup>s\<^esup>irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat \<^bsup>s\<^esup>irq_w)) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> \<^bsup>s\<^esup>irq_w = UCAST(10 \<rightarrow> 32) (toEnum (unat \<^bsup>s\<^esup>irq_w)) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>}}
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
A total of 3 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5017 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) \<acute>irq_w :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) \<lbrace>\<acute>irq_w = args ! 0 \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! Suc 0) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
A total of 3 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] ((case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> case (args, map fst extraCaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([irqW, triggerW, index], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (irqW # triggerW # index # depth # x, cnode # xaa) \<Rightarrow> doE checkIRQ irqW;
irq <- returnOk (toEnum (fromIntegral irqW));
irqActive <- withoutFailure $ isIRQActive irq;
whenE irqActive $ throw Fault_H.syscall_error.RevokeFirst;
destSlot <- lookupTargetSlot cnode (CPtr index) (fromIntegral depth);
ensureEmptySlot destSlot;
returnOk $ local.irqcontrol_invocation.IssueIRQHandler irq destSlot slot (triggerW \<noteq> 0)
odE | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc 0) a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 2 a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation >>= invocationCatch thread isBlocking isCall (Invocations_H.invocation.InvokeIRQControl \<circ> irqcontrol_invocation.ArchIRQControl)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc 0) a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 2 a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4108 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) (?T4110 (option_to_ptr buffer) extraCaps' length___unsigned_long (cte_Ptr slot) label) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc 0) a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 2 a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ?R4108 buffera current_extra_caps length___unsigned_long srcSlot invLabel s)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> ?T4110 buffera current_extra_caps length___unsigned_long srcSlot invLabel)} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; invocation_type label \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc 0) a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 2 a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> True)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (1 subgoal):
 1. \<And>buffera current_extra_caps length___unsigned_long srcSlot invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; unat length___unsigned_long = length args; srcSlot = cte_Ptr slot; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and sch_act_simple and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and (\<lambda>a. sysargs_rel args buffer a \<and> sysargs_rel_n args buffer (Suc 0) a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 2 a \<and> sysargs_rel args buffer a \<and> sysargs_rel_n args buffer 3 a \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) a \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> invs' a \<and> valid_objs' a \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s))) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> True)) \<and> s' \<in> {s. (invocation_type invLabel = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = args ! 0 \<longrightarrow> excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. \<^bsup>t\<^esup>ret__unsigned_long = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C \<^bsup>t\<^esup>ret__struct_lookupSlot_ret_C = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))\<rbrace>)}})}}) \<and> (invocation_type invLabel \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> s \<in> UNIV)} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)) \<and> (invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> toEnum (unat (args ! 0)) \<le> SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<le> UCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (unat (args ! 0) \<le> 159 \<longrightarrow> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>_. True) slot s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; unat (args ! 3) < 2 ^ LENGTH(32)\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (unat (args ! 0) \<le> 159 \<longrightarrow> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>_. True) slot s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; unat (args ! 3) < 4294967296; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (unat (args ! 0) \<le> 159 \<longrightarrow> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>_. True) slot s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s; unat (args ! 3) < 4294967296; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length args < 4; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (unat (args ! 0) \<le> 159 \<longrightarrow> valid_objs' s \<and> unat (args ! Suc (Suc (Suc 0))) < 2 ^ word_bits \<and> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>_. True) slot s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler \<longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> args ! 2 = args ! Suc (Suc 0) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! Suc (Suc (Suc 0))) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s' a b ys t. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem ((a, b) # ys) (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; sysargs_rel args buffer s; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = (a, b) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; \<forall>v\<in>set ys. valid_cap' (fst v) s\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! 3) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s' a b ys t. \<lbrakk>unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem ((a, b) # ys) (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; sysargs_rel args buffer s; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = (a, b) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; \<forall>v\<in>set ys. valid_cap' (fst v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = (cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 0 \<and> (length (cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! 3) \<le> word_bits \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s' a b ys t. \<lbrakk>unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem ((a, b) # ys) (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; sysargs_rel args buffer s; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = (a, b) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; \<forall>v\<in>set ys. valid_cap' (fst v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; length ys < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length ys)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ\<rbrakk> \<Longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! 3) \<le> word_bits \<longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s' a b ys t. \<lbrakk>unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem ((a, b) # ys) (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; sysargs_rel args buffer s; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = (a, b) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; \<forall>v\<in>set ys. valid_cap' (fst v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; length ys < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length ys)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); args ! 0 \<le> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ\<rbrakk> \<Longrightarrow> args ! 0 = UCAST(10 \<rightarrow> 32) (toEnum (unat (args ! 0))) \<and> (\<forall>t rv. ret__unsigned_long_' t = from_bool rv \<longrightarrow> \<not> rv \<longrightarrow> (\<forall>t. lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' t) = cte_Ptr rv) \<and> unat (args ! 3) \<le> word_bits \<longrightarrow> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long s s' a b ys t ta rv tb rva. \<lbrakk>unat length___unsigned_long = length args; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; sch_act_simple s; ct_active' s; excaps_in_mem ((a, b) # ys) (ctes_of s); cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQControlCap) slot s; sysargs_rel args buffer s; invocation_type label = ArchInvocationLabel ARMIRQIssueIRQHandler; \<not> length___unsigned_long < 4; extraCaps = (a, b) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; \<forall>v\<in>set ys. valid_cap' (fst v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; length ys < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length ys)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); unat (args ! 0) \<le> 159; ret__unsigned_long_' ta = SCAST(32 signed \<rightarrow> 32) false; \<not> rv; lookupSlot_ret_C.status_C (ret__struct_lookupSlot_ret_C_' tb) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; unat (args ! 3) \<le> word_bits; lookupSlot_ret_C.slot_C (ret__struct_lookupSlot_ret_C_' tb) = cte_Ptr rva\<rbrakk> \<Longrightarrow> (if args ! Suc 0 \<noteq> 0 then 1 else 0) = from_bool (args ! Suc 0 \<noteq> 0) proof (prove)
goal:
No subgoals!