theory Syscall_C

lemma handleInterrupt_ccorres:
  "ccorres dc xfdc
           (invs')
           (UNIV \<inter> \<lbrace>\<acute>irq = ucast irq\<rbrace>)
           []
           (handleInterrupt irq)
           (Call handleInterrupt_'proc)" apply (cinit lift: irq_' cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp  add: Platform_maxIRQ del: Collect_const) apply (drule ucast_maxIRQ_is_less[simplified]) apply (simp del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (subst doMachineOp_bind) apply (rule maskInterrupt_empty_fail) apply (rule ackInterrupt_empty_fail) apply (ctac add: maskInterrupt_ccorres) apply (subst bind_return_unit[where f="doMachineOp (ackInterrupt irq)"]) apply (ctac add: ackInterrupt_ccorres) apply (rule ccorres_split_throws) apply (rule ccorres_return_void_C) apply vcg apply wp apply (vcg exspec=ackInterrupt_modifies) apply wp apply (vcg exspec=maskInterrupt_modifies) apply (simp add: ucast_maxIRQ_is_not_less Platform_maxIRQ del: Collect_const) apply (rule ccorres_pre_getIRQState) apply wpc apply simp apply (rule ccorres_fail) apply (simp add: bind_assoc cong: call_ignore_cong) apply (rule ccorres_move_const_guards)+ apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule getIRQSlot_ccorres3) apply (rule ccorres_getSlotCap_cte_at) apply (rule_tac P="cte_at' rv" in ccorres_cross_over_guard) supply ccorres_move_array_assertion_tcb_ctes [ccorres_pre del] apply ctac apply csymbr apply csymbr apply (rule ccorres_ntfn_cases) apply (clarsimp cong: call_ignore_cong simp del: Collect_const) apply (rule_tac b=send in ccorres_case_bools) apply simp apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (ctac (no_vcg) add: sendSignal_ccorres) apply (simp add: maskIrqSignal_def) apply (ctac (no_vcg) add: maskInterrupt_ccorres) apply (ctac add: ackInterrupt_ccorres) apply wp+ apply (simp del: Collect_const) apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (rule ccorres_cond_false_seq) apply (simp add: maskIrqSignal_def) apply (ctac (no_vcg) add: maskInterrupt_ccorres) apply (ctac add: ackInterrupt_ccorres) apply wp apply (rule_tac P=\<top> and P'="{s. ret__int_' s = 0 \<and> cap_get_tag cap \<noteq> scast cap_notification_cap}" in ccorres_inst) apply (clarsimp simp: isCap_simps simp del: Collect_const) apply (case_tac rva, simp_all del: Collect_const)[1] prefer 3 apply metis apply ((simp add: maskIrqSignal_def,
                        rule ccorres_guard_imp2,
                        rule ccorres_cond_false_seq, simp,
                        rule ccorres_cond_false_seq, simp,
                        ctac (no_vcg) add: maskInterrupt_ccorres,
                        ctac (no_vcg) add: ackInterrupt_ccorres,
                        wp, simp)+) apply (wp getSlotCap_wp) apply simp apply vcg apply (simp add: bind_assoc) apply (rule ccorres_move_const_guards)+ apply (rule ccorres_cond_false_seq) apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply (ctac (no_vcg) add: timerTick_ccorres) apply (ctac (no_vcg) add: resetTimer_ccorres) apply (ctac add: ackInterrupt_ccorres ) apply wp+ apply (simp add: Platform_maxIRQ maxIRQ_def del: Collect_const) apply (rule ccorres_move_const_guards)+ apply (rule ccorres_cond_false_seq) apply (rule ccorres_cond_false_seq) apply (rule ccorres_cond_true_seq) apply (ctac add: ccorres_handleReserveIRQ) apply (ctac (no_vcg) add: ackInterrupt_ccorres) apply wp apply vcg apply (simp add: sint_ucast_eq_uint is_down uint_up_ucast is_up) apply (clarsimp simp: word_sless_alt word_less_alt word_le_def Kernel_C.maxIRQ_def
                        uint_up_ucast is_up_def
                        source_size_def target_size_def word_size
                        sint_ucast_eq_uint is_down is_up word_0_sle_from_less) apply (rule conjI) apply (clarsimp simp: cte_wp_at_ctes_of) using un_ui_le[of irq maxIRQ] apply (clarsimp simp: IRQTimer_def IRQSignal_def maxIRQ_def
                        cte_wp_at_ctes_of ucast_ucast_b is_up) apply (intro conjI impI) apply clarsimp apply (erule(1) cmap_relationE1[OF cmap_relation_cte]) apply (clarsimp simp: typ_heap_simps') apply (simp add: cap_get_tag_isCap) apply (clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_get_tag_to_H, assumption) apply (clarsimp simp: to_bool_def) apply (fastforce simp: unat_gt_0 intro!: array_assertion_abs_irq[rule_format]) apply (simp add: rf_sr_def cstate_relation_def Let_def) apply (clarsimp simp: IRQReserved_def)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' (UNIV \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>) [] (handleInterrupt irq) (Call handleInterrupt_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>irqa. irqa = UCAST(10 \<rightarrow> 32) irq \<Longrightarrow> ccorres dc xfdc (?Q1060 irqa) (?Q'1060 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (IF SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa);;
CALL ackInterrupt_'proc(irqa);;
return_void_C
FI;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1060 irqa s \<and> s' \<in> ?Q'1060 irqa proof (prove)
goal (3 subgoals):
 1. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1066 irqa) (?S1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa);;
CALL ackInterrupt_'proc(irqa);;
return_void_C;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (3 subgoals):
 1. SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq \<Longrightarrow> ccorres dc xfdc (?Q1066 (UCAST(10 \<rightarrow> 32) irq)) (?S1066 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (if SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (3 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> ccorres dc xfdc (?Q1066 (UCAST(10 \<rightarrow> 32) irq)) (?S1066 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (if SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (3 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> ccorres dc xfdc (?Q1066 (UCAST(10 \<rightarrow> 32) irq)) (?S1066 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (doMachineOp (do y <- maskInterrupt True irq;
ackInterrupt irq
od)) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (3 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> ccorres dc xfdc (?Q1066 (UCAST(10 \<rightarrow> 32) irq)) (?S1066 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (doMachineOp (do y <- maskInterrupt True irq;
ackInterrupt irq
od)) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
(CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
(return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (5 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> empty_fail (maskInterrupt True irq)
 2. \<And>x. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> empty_fail (ackInterrupt irq)
 3. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> ccorres dc xfdc (?Q1085 (UCAST(10 \<rightarrow> 32) irq)) (?S1085 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (do rv <- doMachineOp (maskInterrupt True irq);
doMachineOp (ackInterrupt irq)
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
(CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
(return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 4. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?S1085 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?S1066 (UCAST(10 \<rightarrow> 32) irq)
?Q1085 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?Q1066 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (4 subgoals):
 1. \<And>x. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> empty_fail (ackInterrupt irq)
 2. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> ccorres dc xfdc (?Q1085 (UCAST(10 \<rightarrow> 32) irq)) (?S1085 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (do rv <- doMachineOp (maskInterrupt True irq);
doMachineOp (ackInterrupt irq)
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
(CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
(return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 3. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?S1085 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?S1066 (UCAST(10 \<rightarrow> 32) irq)
?Q1085 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?Q1066 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (3 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> ccorres dc xfdc (?Q1085 (UCAST(10 \<rightarrow> 32) irq)) (?S1085 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (do rv <- doMachineOp (maskInterrupt True irq);
doMachineOp (ackInterrupt irq)
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
(CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
(return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?Q1066 irqa s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?S1066 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?S1085 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?S1066 (UCAST(10 \<rightarrow> 32) irq)
?Q1085 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?Q1066 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (5 subgoals):
 1. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1091 rv) (?Q'1091 rv xfdca) [SKIP] (doMachineOp (ackInterrupt irq)) (CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
(return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>?Q1091\<rbrace>
 3. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1091 rv (xfdc s)}
 4. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (5 subgoals):
 1. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1136 rv xfdca (?rv1136 rv xfdca)) (?Q'1136 rv xfdca (?rv1136 rv xfdca) (?xfdc1136 rv xfdca)) [SKIP] (do x <- doMachineOp (ackInterrupt irq);
return ()
od) (CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq);;
(return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>?Q1091\<rbrace>
 3. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1136 rv (xfdc s) (?rv1136 rv (xfdc s)) (?xfdc1136 rv (xfdc s))}
 4. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
\<lambda>rv xfdc. ?Q1136 rv xfdc (?rv1136 rv xfdc) \<equiv>\<^sup>? \<lambda>rv xfdc. ?Q1091 rv
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (7 subgoals):
 1. \<And>rv xfdca rva xfdcb. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 rv xfdca rva) (?Q'1140 rv xfdca rva xfdcb) [SKIP] (return ()) (return_void_C;;
(Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>rv xfdc. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 rv xfdc (?rv1136 rv xfdc)\<rbrace> doMachineOp (ackInterrupt irq) \<lbrace>?Q1140 rv xfdc\<rbrace>
 3. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1141 rv xfdca (?rv1136 rv xfdca) (?xfdc1136 rv xfdca)) CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'1140 rv xfdca rva (xfdc s)}
 4. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a b. ((\<lambda>a. True) and ?R1145 a b) b\<rbrace>
 5. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> ?R'1141 rv (xfdc s) (?rv1136 rv (xfdc s)) (?xfdc1136 rv (xfdc s))}
 6. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
\<lambda>rv xfdc a. ?R1148 rv xfdc (?rv1136 rv xfdc) \<equiv>\<^sup>? \<lambda>rv xfdc. ?R1145 rv
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (8 subgoals):
 1. \<And>rv xfdca rva xfdcb. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 rv xfdca rva) (?P'1180 rv xfdca rva xfdcb) [SKIP] (return ()) return_void_C
 2. \<And>rv xfdca rva xfdc. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1180 rv xfdca rva xfdc) return_void_C {},UNIV
 3. \<And>rv xfdc. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 rv xfdc (?rv1136 rv xfdc)\<rbrace> doMachineOp (ackInterrupt irq) \<lbrace>?Q1140 rv xfdc\<rbrace>
 4. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1141 rv xfdca (?rv1136 rv xfdca) (?xfdc1136 rv xfdca)) CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?P'1180 rv xfdca rva (xfdc s) \<inter> ?R'1180 rv xfdca rva (xfdc s)}
 5. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a b. ((\<lambda>a. True) and ?R1145 a b) b\<rbrace>
 6. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> ?R'1141 rv (xfdc s) (?rv1136 rv (xfdc s)) (?xfdc1136 rv (xfdc s))}
 7. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
\<lambda>rv xfdc a. ?R1148 rv xfdc (?rv1136 rv xfdc) \<equiv>\<^sup>? \<lambda>rv xfdc. ?R1145 rv
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (7 subgoals):
 1. \<And>rv xfdca rva xfdc. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1180 rv xfdca rva xfdc) return_void_C {},UNIV
 2. \<And>rv xfdc. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 rv xfdc (?rv1136 rv xfdc)\<rbrace> doMachineOp (ackInterrupt irq) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1141 rv xfdca (?rv1136 rv xfdca) (?xfdc1136 rv xfdca)) CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> ?R'1180 rv xfdca rva (xfdc s)}
 4. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a b. ((\<lambda>a. True) and ?R1145 a b) b\<rbrace>
 5. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> ?R'1141 rv (xfdc s) (?rv1136 rv (xfdc s)) (?xfdc1136 rv (xfdc s))}
 6. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
\<lambda>rv xfdc a. ?R1148 rv xfdc (?rv1136 rv xfdc) \<equiv>\<^sup>? \<lambda>rv xfdc. ?R1145 rv
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (6 subgoals):
 1. \<And>rv xfdc. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 rv xfdc (?rv1136 rv xfdc)\<rbrace> doMachineOp (ackInterrupt irq) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1141 rv xfdca (?rv1136 rv xfdca) (?xfdc1136 rv xfdca)) CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 3. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a b. ((\<lambda>a. True) and ?R1145 a b) b\<rbrace>
 4. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> ?R'1141 rv (xfdc s) (?rv1136 rv (xfdc s)) (?xfdc1136 rv (xfdc s))}
 5. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
\<lambda>rv xfdc a. ?R1148 rv xfdc (?rv1136 rv xfdc) \<equiv>\<^sup>? \<lambda>rv xfdc. ?R1145 rv
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (5 subgoals):
 1. \<And>rv xfdca. \<lbrakk>SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq; dc rv xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1141 rv xfdca (?rv1136 rv xfdca) (?xfdc1136 rv xfdca)) CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>}
 2. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 3. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> ?R'1141 rv (xfdc s) (?rv1136 rv (xfdc s)) (?xfdc1136 rv (xfdc s))}
 4. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (4 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<lbrace>?R1102 (UCAST(10 \<rightarrow> 32) irq)\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 2. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and ?R1104 irqa) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?R1104 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R1102 (UCAST(10 \<rightarrow> 32) irq)
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (3 subgoals):
 1. SCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ < irq \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1092 (UCAST(10 \<rightarrow> 32) irq)) CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> ?R'1094 irqa) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)}
flex-flex pairs:
?R'1094 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? ?R'1092 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (2 subgoals):
 1. \<And>irqa. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1066 irqa) (?T1066 irqa) [SKIP] (if local.maxIRQ < irq then doMachineOp $ do maskInterrupt True irq;
ackInterrupt irq
od else do st <- getIRQState irq;
case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp $ ackInterrupt irq
od) (SKIP;;
(Guard ArrayBounds \<lbrace>irqa < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>irqa < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irqa) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(\<acute>cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(\<acute>cap);;
CALL sendSignal_'proc(ntfn_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(irqa)
ELSE
  IF \<acute>intStateIRQTable.[unat irqa] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,irqa)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(irqa)))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (2 subgoals):
 1. \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq \<Longrightarrow> ccorres dc xfdc (?R1066 (UCAST(10 \<rightarrow> 32) irq)) (?T1066 (UCAST(10 \<rightarrow> 32) irq)) [SKIP] (do st <- getIRQState irq;
y <- case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ?R1066 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> ?T1066 irqa)} proof (prove)
goal (2 subgoals):
 1. \<And>st. \<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq \<Longrightarrow> ccorres dc xfdc (?P1237 st) (?P'1252 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do y <- case st of irqstate.IRQInactive \<Rightarrow> haskell_fail $ [] @ show irq | irqstate.IRQSignal \<Rightarrow> do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od | irqstate.IRQTimer \<Rightarrow> do timerTick;
doMachineOp resetTimer
od | irqstate.IRQReserved \<Rightarrow> handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> ?P1251 irqa s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> ?P'1252 irqa rv})}
flex-flex pairs:
?P1251 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?P1237 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (5 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQInactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1275 st) (?R''1288 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- haskell_fail $ [] @ show irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1274 st) (?R''1287 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> ?R1284 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ?R1283 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> ?R''1288 irqa rv} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R''1287 irqa rv} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1284 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1275 (intStateIRQTable (ksInterruptState s) irq) s
?R1283 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1274 (intStateIRQTable (ksInterruptState s) irq) s
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (5 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQInactive\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1275 irqstate.IRQInactive) (?R''1288 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQInactive) [SKIP] fail (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0xA0 then UNIV else {}) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1274 st) (?R''1287 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> ?R1284 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ?R1283 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> ?R''1288 irqa rv} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R''1287 irqa rv} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1284 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1275 (intStateIRQTable (ksInterruptState s) irq) s
?R1283 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1274 (intStateIRQTable (ksInterruptState s) irq) s
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1274 st) (?R''1287 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
case cap of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
maskIrqSignal irq
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ?R1283 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R''1287 irqa rv} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1283 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1274 (intStateIRQTable (ksInterruptState s) irq) s
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1274 irqstate.IRQSignal) (?R''1287 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal) [SKIP] (do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
x <- case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0xA0 then UNIV else {}) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ?R1283 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R''1287 irqa rv} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1283 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1274 (intStateIRQTable (ksInterruptState s) irq) s
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1300 irqstate.IRQSignal) (?R''1287 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal) [SKIP] (do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
x <- case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> (?P1298 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R''1287 irqa rv} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P1300 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P1298 (UCAST(10 \<rightarrow> 32) irq)
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1300 irqstate.IRQSignal) (?R'1304 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal) [SKIP] (do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
x <- case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> (?P1298 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R'1304 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P1300 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P1298 (UCAST(10 \<rightarrow> 32) irq)
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1300 irqstate.IRQSignal) (?R'1304 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal) [SKIP] (do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
x <- case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (lvar_nondet_init cap_' cap_'_update;;
(Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))))))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> (?P1298 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> ?R'1304 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P1300 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P1298 (UCAST(10 \<rightarrow> 32) irq)
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1300 irqstate.IRQSignal) (?G'1339 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal) [SKIP] (do slot <- getIRQSlot irq;
cap <- getSlotCap slot;
x <- case cap of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> (?P1298 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> ?G'1339 irqa rv} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P1300 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P1298 (UCAST(10 \<rightarrow> 32) irq)
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1365 rv) (?P'1367 rv) [SKIP] (do cap <- getSlotCap rv;
x <- case cap of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr cap) (capNtfnBadge cap) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> (?P1298 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> ?P'1366 irqa rv}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?P'1367 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?P'1366 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
\<lambda>s. ?P1365 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq)) s \<equiv>\<^sup>? ?P1300 irqstate.IRQSignal
\<lambda>s. ?P1300 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P1298 (UCAST(10 \<rightarrow> 32) irq)
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?G1386 rv) (?P'1367 rv) [SKIP] (do a <- getSlotCap rv;
x <- case a of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr a) (capNtfnBadge a) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> ?G1384 irqa s a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> ?P'1366 irqa rv}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?G1384 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?G1383 (intStateIRQTable (ksInterruptState s) irq)
\<lambda>s. ?G1386 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq)) s \<equiv>\<^sup>? ?G1383 irqstate.IRQSignal
?P'1367 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?P'1366 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1398 rv) (?Q1395 rv) [SKIP] (do a <- getSlotCap rv;
x <- case a of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr a) (capNtfnBadge a) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ?P'1393 irqa s a) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> ?Q1396 irqa rv}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?P'1393 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?P'1392 (intStateIRQTable (ksInterruptState s) irq)
\<lambda>s. ?P'1398 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq)) \<equiv>\<^sup>? ?P'1392 irqstate.IRQSignal
?Q1395 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?Q1396 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1398 rv) (?Q1395 rv) [SKIP] (do a <- getSlotCap rv;
x <- case a of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr a) (capNtfnBadge a) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ?P'1393 irqa s a) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> ?Q1396 irqa rv}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?P'1393 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?P'1392 (intStateIRQTable (ksInterruptState s) irq)
\<lambda>s. ?P'1398 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq)) \<equiv>\<^sup>? ?P'1392 irqstate.IRQSignal
?Q1395 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?Q1396 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (6 subgoals):
 1. \<And>st rv rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1418 st rv rva) (?Q'1418 st rv rva cap) [SKIP] (do x <- case rva of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))))
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>?Q1418 st rv\<rbrace>
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> ?Q'1418 st rv rva (cap_' s)}
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (6 subgoals):
 1. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1418 st rv rva) (?G'1786 st rv rva cap ret__unsigned) [SKIP] (do x <- case rva of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__int :== (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>?Q1418 st rv\<rbrace>
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1786 st rv rva (cap_' s) v}}
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (6 subgoals):
 1. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1418 st rv rva) (?G'1925 st rv rva cap ret__unsigned) [SKIP] (do x <- case rva of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>?Q1418 st rv\<rbrace>
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> ?G'1925 st rv rva (cap_' s) v}}}
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>st rv rva cap ret__unsigned p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; rva = capability.NotificationCap p b send d\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P2058 st rv rva a p b send d) (?P'2042 st rv rva cap ret__unsigned p b send d) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> ?P2058 st rv a b p ba send d) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> ?P'2042 st rv rva (cap_' s) v p b send d} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P2058 irqstate.IRQSignal rv (capability.NotificationCap p b send d) a p b send d) (?P'2042 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case send of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b send d)) (capNtfnBadge (capability.NotificationCap p b send d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> ?P2058 st rv a b p ba send d) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> ?P'2042 st rv rva (cap_' s) v p b send d} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?P'2077 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case True of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b True d)) (capNtfnBadge (capability.NotificationCap p b True d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> ?P'2077 st rv rva (cap_' s) v p b send d} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?P'2077 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (Cond (if cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)) SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> ?P'2077 st rv rva (cap_' s) v p b send d} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'2088 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> ?R'2088 st rv rva (cap_' s) v p b send d \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'2088 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> ?R'2088 st rv rva (cap_' s) v p b send d \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?G'2103 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigned) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__int :== (if ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> ?G'2103 st rv rva (cap_' s) v p b send d va}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?G'2244 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigned) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'2244 st rv rva (cap_' s) v p b send d va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'2444 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigned) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?R'2444 st rv rva (cap_' s) v p b send d va \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'2444 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigned) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2);;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?R'2444 st rv rva (cap_' s) v p b send d va \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigneda ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?G'2462 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigneda ret__unsigned) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
(CALL sendSignal_'proc(ntfn_Ptr ret__unsigned,\<acute>unsigned_eret_2);;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>vb v'. vb = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> ?G'2462 st rv rva (cap_' s) v p b send d va vb}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2080 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?G'2620 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigneda ret__unsigned unsigned_eret_2) [SKIP] (do x <- sendSignal p b;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (CALL sendSignal_'proc(ntfn_Ptr ret__unsigned,unsigned_eret_2);;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> ?P2080 st rv a p ba send d b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>vb v'. vb = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {sa. sa \<in> ?G'2620 st rv rva (cap_' s) v p b send d va vb vc}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (9 subgoals):
 1. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 rva xfdca. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2739 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 rva) (?Q'2739 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 rva xfdca) [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R2748 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d\<rbrace> sendSignal p b \<lbrace>?Q2739 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and ?R2748 st rv a p ba send d) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 6. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>vb v'. vb = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {sa. sa \<in> {s. badge_'_update (\<lambda>_. vc) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr vb) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2745 st rv rva (cap_' s) v p b send d va vb vc t rvb}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 9. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>rv cap p b send d. ?Q'2745 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d \<equiv>\<^sup>? \<lambda>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 t rva. ?Q'2739 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 rva (xfdc t)
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (9 subgoals):
 1. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 xfdca. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2739 rv cap p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) ()) (?Q'2739 rv cap p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) () xfdca) [SKIP] (do y <- doMachineOp (maskInterrupt True irq);
doMachineOp (ackInterrupt irq)
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R2748 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d\<rbrace> sendSignal p b \<lbrace>?Q2739 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and ?R2748 st rv a p ba send d) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 6. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>vb v'. vb = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {sa. sa \<in> {s. badge_'_update (\<lambda>_. vc) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr vb) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2745 st rv rva (cap_' s) v p b send d va vb vc t rvb}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 9. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>rv cap p b send d. ?Q'2745 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d \<equiv>\<^sup>? \<lambda>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 t rva. ?Q'2739 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 rva (xfdc t)
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (10 subgoals):
 1. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 xfdca rva xfdcb. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap); dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2785 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 xfdca rva) (?Q'2803 rv cap p b send d xfdca rva xfdcb) [SKIP] (doMachineOp (ackInterrupt irq)) (CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 xfdc. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R2797 rv cap p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) ()\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>?Q2785 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 xfdc\<rbrace>
 3. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R2748 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d\<rbrace> sendSignal p b \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2797 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 a\<rbrace>
 4. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 6. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and ?R2748 st rv a p ba send d) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 7. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>vb v'. vb = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := vb\<rparr> \<in> {sa. sa \<in> {sa. \<forall>vc v'. vc = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {sa. sa \<in> {s. badge_'_update (\<lambda>_. vc) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr vb) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'2804 st rv rva (cap_' s) v p b send d va vb vc t rvb ta rvc}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 8. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 9. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 10. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>rv cap p b send d. ?Q'2804 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d \<equiv>\<^sup>? \<lambda>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 t rva. ?Q'2802 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 rva (xfdc t)
\<lambda>rv cap p b send d xfdca t rva. ?Q'2803 rv cap p b send d xfdca rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv cap p b send d. ?Q'2802 rv cap p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) ()
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (9 subgoals):
 1. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 xfdc. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R2797 rv cap p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap)) (capNtfnPtr_CL (cap_notification_cap_lift cap)) (capNtfnBadge_CL (cap_notification_cap_lift cap)) ()\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigneda = capNtfnCanSend_CL (cap_notification_cap_lift cap); ret__unsigned = capNtfnPtr_CL (cap_notification_cap_lift cap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R2748 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d\<rbrace> sendSignal p b \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R2797 rv cap p b send d ret__unsigneda ret__unsigned unsigned_eret_2 a\<rbrace>
 3. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and ?R2748 st rv a p ba send d) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 6. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 9. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do x <- case False of True \<Rightarrow> sendSignal (capNtfnPtr (capability.NotificationCap p b False d)) (capNtfnBadge (capability.NotificationCap p b False d)) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?Q'2076 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?Q'2076 st rv rva (cap_' s) v p b send d}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'2859 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?R'2859 st rv rva (cap_' s) v p b send d \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'2859 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d) [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> ?R'2859 st rv rva (cap_' s) v p b send d \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?G'3015 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigned) [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'3015 st rv rva (cap_' s) v p b send d va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'3215 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d ret__unsigned) [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (SKIP;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?R'3215 st rv rva (cap_' s) v p b send d va \<inter> - \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2078 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d) (?R'3215 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap))) [SKIP] (do y <- doMachineOp (maskInterrupt True irq);
doMachineOp (ackInterrupt irq)
od) (CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ?Q2078 st rv a p ba send d b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?R'3215 st rv rva (cap_' s) v p b send d va \<inter> - \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (8 subgoals):
 1. \<And>rv cap p b send d ret__unsigned rva xfdca. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap); dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3231 rv cap p b send d ret__unsigned rva) (?Q'3245 rv cap p b send d rva xfdca) [SKIP] (doMachineOp (ackInterrupt irq)) (CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R3239 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>?Q3231 rv cap p b send d ret__unsigned\<rbrace>
 3. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and ?R3239 st rv a p ba send d) b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 5. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3244 st rv rva (cap_' s) v p b send d va t rvb} \<inter> - \<lbrace>(if va \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 8. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>rv cap p b send d t rva. ?Q'3245 rv cap p b send d rva (xfdc t) \<equiv>\<^sup>? \<lambda>rv cap p b send d. ?Q'3244 irqstate.IRQSignal rv (capability.NotificationCap p b send d) cap (cap_get_tag cap) p b send d (capNtfnCanSend_CL (cap_notification_cap_lift cap))
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (7 subgoals):
 1. \<And>rv cap p b send d ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap p b send d) cap; ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R3239 irqstate.IRQSignal rv (capability.NotificationCap p b send d) p b send d\<rbrace> doMachineOp (maskInterrupt True irq) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and ?R3239 st rv a p ba send d) b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 4. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}} \<inter> - \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 7. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (6 subgoals):
 1. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2057 st rv rva rva) (?Q'2042 st rv rva cap ret__unsigned rva) [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap a \<longrightarrow> ?Q2057 st rv a a b)\<rbrace>
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rva. ccap_relation rva (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rva = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}} \<inter> - \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rva \<longrightarrow> sa \<in> ?Q'2042 st rv rva (cap_' s) v rva}}}}
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (6 subgoals):
 1. \<And>st rv rva cap ret__unsigned. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal; ccap_relation rva cap; ret__unsigned = cap_get_tag cap; \<not> isNotificationCap rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do x <- case rva of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rv = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}} \<inter> - \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rv \<longrightarrow> sa \<in> \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag \<^bsup>s\<^esup>cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}}}}
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (6 subgoals):
 1. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation rva cap; \<forall>v0 v1 v2 v3. rva \<noteq> capability.NotificationCap v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do x <- case rva of capability.NotificationCap x xa True xb \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | capability.NotificationCap x xa False xb \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq | _ \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 3. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rv = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}} \<inter> - \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rv \<longrightarrow> sa \<in> \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag \<^bsup>s\<^esup>cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}}}}
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 6. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (17 subgoals):
 1. \<And>rva cap x1. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ThreadCap x1) cap; rva = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation capability.NullCap cap; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>rva cap x31 x32 x33 x34. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap; (\<forall>v2. x33 = (\<not> v2)) \<or> (\<forall>v3. x34 = (\<not> v3)); rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do x <- case x33 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>rva cap x4. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.IRQHandlerCap x4) cap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>rva cap x51 x52 x53 x54 x55 x56. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 6. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation capability.DomainCap cap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 7. \<And>rva cap x71 x72 x73. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.Zombie x71 x72 x73) cap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 8. \<And>rva cap x8. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ArchObjectCap x8) cap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 9. \<And>rva cap x91 x92 x93. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ReplyCap x91 x92 x93) cap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 10. \<And>rva cap x101 x102 x103 x104. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
A total of 17 subgoals...
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (17 subgoals):
 1. \<And>rva cap x31 x32 x33 x34. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.NotificationCap x31 x32 x33 x34) cap; (\<forall>v2. x33 = (\<not> v2)) \<or> (\<forall>v3. x34 = (\<not> v3)); rva = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do x <- case x33 of True \<Rightarrow> sendSignal (capNtfnPtr rva) (capNtfnBadge rva) | False \<Rightarrow> doMachineOp $ debugPrint $ [] @ show irq;
y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rva cap x1. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ThreadCap x1) cap; rva = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation capability.NullCap cap; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>rva cap x4. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.IRQHandlerCap x4) cap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>rva cap x51 x52 x53 x54 x55 x56. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 6. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation capability.DomainCap cap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 7. \<And>rva cap x71 x72 x73. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.Zombie x71 x72 x73) cap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 8. \<And>rva cap x8. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ArchObjectCap x8) cap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 9. \<And>rva cap x91 x92 x93. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ReplyCap x91 x92 x93) cap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 10. \<And>rva cap x101 x102 x103 x104. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
A total of 17 subgoals...
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (16 subgoals):
 1. \<And>rva cap x1. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ThreadCap x1) cap; rva = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 2. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation capability.NullCap cap; rva = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 3. \<And>rva cap x4. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.IRQHandlerCap x4) cap; rva = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 4. \<And>rva cap x51 x52 x53 x54 x55 x56. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) cap; rva = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 5. \<And>rva cap. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation capability.DomainCap cap; rva = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 6. \<And>rva cap x71 x72 x73. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.Zombie x71 x72 x73) cap; rva = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 7. \<And>rva cap x8. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ArchObjectCap x8) cap; rva = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 8. \<And>rva cap x91 x92 x93. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.ReplyCap x91 x92 x93) cap; rva = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 9. \<And>rva cap x101 x102 x103 x104. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.UntypedCap x101 x102 x103 x104) cap; rva = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
 10. \<And>rva cap x111 x112 x113 x114. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; ccap_relation (capability.CNodeCap x111 x112 x113 x114) cap; rva = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace> [SKIP] (do y <- maskIrqSignal irq;
doMachineOp (ackInterrupt irq)
od) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(cap);;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
(CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))))
A total of 16 subgoals...
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (5 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<lbrace>?R1446 rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. (\<forall>p ba send d. a = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap a \<longrightarrow> True)\<rbrace>
 2. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rv = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}} \<inter> - \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rv \<longrightarrow> sa \<in> \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag \<^bsup>s\<^esup>cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}}}}
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and ?R1451 irqa s a)) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1451 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1449 (intStateIRQTable (ksInterruptState s) irq)
?R1449 irqstate.IRQSignal \<equiv>\<^sup>? \<lambda>s. ?R1446 (irq_node' s + 2 ^ cte_level_bits * word_of_nat (unat irq))
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. \<forall>p b send d. rv = capability.NotificationCap p b send d \<longrightarrow> sa \<in> {sa. send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. \<forall>v v'. v = capNtfnPtr_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. badge_'_update (\<lambda>_. va) (ntfnPtr_'_update (\<lambda>_. ntfn_Ptr v) s) \<in> UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr p\<rbrace> \<inter> \<lbrace>\<acute>badge = b\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> (if v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then UNIV else {})} \<inter> {sa. \<not> send \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>x. cap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}} \<inter> - \<lbrace>(if v \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrace>}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap} \<inter> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}} \<inter> {sa. \<not> isNotificationCap rv \<longrightarrow> sa \<in> \<lbrace>\<acute>ret__int = 0 \<and> cap_get_tag \<^bsup>s\<^esup>cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrace>}}}}
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQSignal\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1443 rv) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<lbrace>\<forall>rv. ccap_relation rv \<acute>cap \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift \<acute>cap) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift \<acute>cap) = b \<and> cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift \<acute>cap) \<noteq> 0 \<and> cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift \<acute>cap) = 0 \<and> cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag \<acute>cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace>
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> ?R'1441 irqa rv \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R'1443 (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint (UCAST(10 \<rightarrow> 32) irq))) \<equiv>\<^sup>? ?R'1441 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQSignal
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 st) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- do timerTick;
doMachineOp resetTimer
od;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1273 irqstate.IRQTimer) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer) [SKIP] (do x <- timerTick;
y <- doMachineOp resetTimer;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0xA0 then UNIV else {}) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> ?R1282 irqa s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1282 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1273 (intStateIRQTable (ksInterruptState s) irq) s
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4261 irqstate.IRQTimer) (?R''1286 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer) [SKIP] (do x <- timerTick;
y <- doMachineOp resetTimer;
doMachineOp (ackInterrupt irq)
od) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds (if UCAST(10 \<rightarrow> 32) irq < 0x100 then UNIV else {}) (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (?P4259 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R''1286 irqa rv} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P4261 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4259 (UCAST(10 \<rightarrow> 32) irq)
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4261 irqstate.IRQTimer) (?R'4265 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer) [SKIP] (do x <- timerTick;
y <- doMachineOp resetTimer;
doMachineOp (ackInterrupt irq)
od) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI;;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (?P4259 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R'4265 irqa rv \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P4261 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4259 (UCAST(10 \<rightarrow> 32) irq)
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4261 irqstate.IRQTimer) (?R'4270 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer) [SKIP] (do x <- timerTick;
y <- doMachineOp resetTimer;
doMachineOp (ackInterrupt irq)
od) (CALL timerTick_'proc();;
CALL resetTimer_'proc();;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (?P4259 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R'4270 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P4261 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4259 (UCAST(10 \<rightarrow> 32) irq)
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4261 irqstate.IRQTimer) (?R'4270 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer) [SKIP] (do x <- timerTick;
y <- doMachineOp resetTimer;
doMachineOp (ackInterrupt irq)
od) (CALL timerTick_'proc();;
(CALL resetTimer_'proc();;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq)))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (?P4259 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> ?R'4270 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P4261 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4259 (UCAST(10 \<rightarrow> 32) irq)
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv xfdca. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4282 st rv) (?Q'4299 rv xfdca) [SKIP] (do y <- doMachineOp resetTimer;
doMachineOp (ackInterrupt irq)
od) (CALL resetTimer_'proc();;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> \<lbrace>?R4292 irqstate.IRQTimer\<rbrace> timerTick \<lbrace>?Q4282 st\<rbrace>
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and ?R4296 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'4298 irqa rv t rva} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R4296 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R4292 (intStateIRQTable (ksInterruptState s) irq)
\<lambda>t rv. ?Q'4299 rv (xfdc t) \<equiv>\<^sup>? ?Q'4298 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (5 subgoals):
 1. \<And>st rv xfdca rva xfdcb. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4330 st rv xfdca rva) (?Q'4347 rv xfdca rva xfdcb) [SKIP] (doMachineOp (ackInterrupt irq)) (CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st rv xfdc. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4343 st rv\<rbrace> doMachineOp resetTimer \<lbrace>?Q4330 st rv xfdc\<rbrace>
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> \<lbrace>?R4292 irqstate.IRQTimer\<rbrace> timerTick \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4343 st a\<rbrace>
 4. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 5. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and ?R4296 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4348 irqa rv t rva ta rvb}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?Q'4348 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQTimer \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'4347 rv (xfdc t) rva (xfdc ta)
?R4296 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R4292 (intStateIRQTable (ksInterruptState s) irq)
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (4 subgoals):
 1. \<And>st rv xfdc. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4343 st rv\<rbrace> doMachineOp resetTimer \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQTimer\<rbrakk> \<Longrightarrow> \<lbrace>?R4292 irqstate.IRQTimer\<rbrace> timerTick \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R4343 st a\<rbrace>
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and ?R4296 irqa s and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R4296 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R4292 (intStateIRQTable (ksInterruptState s) irq)
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 st) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) st) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1272 irqstate.IRQReserved) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0xA0\<rbrace> (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ?R1281 irqa s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
?R1281 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R1272 (intStateIRQTable (ksInterruptState s) irq) s proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4410 irqstate.IRQReserved) (?R''1285 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal THEN
  lvar_nondet_init cap_' cap_'_update;;
Guard ArrayBounds \<lbrace>UCAST(10 \<rightarrow> 32) irq < 0x100\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} (Guard MemorySafety \<lbrace>UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnPtr_'proc();;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc();;
CALL sendSignal_'proc(ntfn_Ptr \<acute>ret__unsigned,\<acute>unsigned_eret_2)
FI;;
CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI;;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> (?P4408 irqa s and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R''1285 irqa rv}))})}
flex-flex pairs:
\<lambda>s. ?P4410 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4408 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4410 irqstate.IRQReserved) (?R'4414 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer THEN
  CALL timerTick_'proc();;
CALL resetTimer_'proc()
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI
FI;;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> (?P4408 irqa s and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R'4414 irqa rv \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})}
flex-flex pairs:
\<lambda>s. ?P4410 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4408 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4410 irqstate.IRQReserved) (?R'4419 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved THEN
  CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq)
ELSE
  IF \<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQInactive THEN
  CALL maskInterrupt_'proc(SCAST(32 signed \<rightarrow> 32) true,UCAST(10 \<rightarrow> 32) irq)
ELSE
  Guard DontReach {} SKIP
FI
FI;;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> (?P4408 irqa s and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R'4419 irqa rv \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})}
flex-flex pairs:
\<lambda>s. ?P4410 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4408 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4410 irqstate.IRQReserved) (?R'4424 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) [SKIP] (do a <- handleReservedIRQ irq;
doMachineOp (ackInterrupt irq)
od) (CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq);;
CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> (?P4408 irqa s and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> ?R'4424 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})}
flex-flex pairs:
\<lambda>s. ?P4410 (intStateIRQTable (ksInterruptState s) irq) \<equiv>\<^sup>? ?P4408 (UCAST(10 \<rightarrow> 32) irq) proof (prove)
goal (4 subgoals):
 1. \<And>st rv xfdca. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4432 st rv) (?Q'4432 st rv xfdca) [SKIP] (doMachineOp (ackInterrupt irq)) (CALL ackInterrupt_'proc(UCAST(10 \<rightarrow> 32) irq))
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> \<lbrace>?R4442 irqstate.IRQReserved\<rbrace> handleReservedIRQ irq \<lbrace>?Q4432 st\<rbrace>
 3. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4433 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4432 st rv (xfdc s)}
 4. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ((\<lambda>a. True) and ?R4446 irqa s and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV} \<inter> ?R'4433 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})}
flex-flex pairs:
?R4446 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R4442 (intStateIRQTable (ksInterruptState s) irq) proof (prove)
goal (3 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> \<lbrace>?R4442 irqstate.IRQReserved\<rbrace> handleReservedIRQ irq \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4433 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}
 3. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ((\<lambda>a. True) and ?R4446 irqa s and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV} \<inter> ?R'4433 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})}
flex-flex pairs:
?R4446 (UCAST(10 \<rightarrow> 32) irq) \<equiv>\<^sup>? \<lambda>s. ?R4442 (intStateIRQTable (ksInterruptState s) irq) proof (prove)
goal (2 subgoals):
 1. \<And>st. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq; st = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4433 (UCAST(10 \<rightarrow> 32) irq) irqstate.IRQReserved) CALL handleReservedIRQ_'proc(UCAST(10 \<rightarrow> 32) irq) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. UCAST(10 \<rightarrow> 32) irq) s \<in> UNIV}}
 2. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV} \<inter> ?R'4433 irqa rv \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})} proof (prove)
goal (1 subgoal):
 1. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQInactive \<longrightarrow> True) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> ((\<lambda>a. cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) a \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) and ((\<lambda>a. True) and (\<lambda>b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' a + 2 ^ cte_level_bits * word_of_nat (unat irq)) b \<and> (\<forall>p ba send d. cap = capability.NotificationCap p ba send d \<longrightarrow> (send \<longrightarrow> (invs' and (\<lambda>a. True \<and> True)) b) \<and> (\<not> send \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) b)) \<and> (\<not> isNotificationCap cap \<longrightarrow> True)))) a) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> (invs' and (\<lambda>a. True \<and> True) and K (irqa < 0xA0)) s) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and K (irqa < 0xA0)) s))) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) (disable_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) s) \<in> \<lbrace>\<acute>disable = from_bool True\<rbrace> \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < irqa \<longrightarrow> s \<in> {s. \<forall>rv. intStateIRQTable_' (globals s).[unat irq] = irqstate_to_C rv \<longrightarrow> s \<in> {s. rv = irqstate.IRQInactive \<longrightarrow> s \<in> UNIV} \<inter> ({s. rv = irqstate.IRQSignal \<longrightarrow> s \<in> {s. \<forall>v. cap_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa)) s \<longrightarrow> s' \<in> \<lbrace>cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (ptr_val (intStateIRQNode_Ptr +\<^sub>p uint irqa))\<rbrace> \<inter> \<lbrace>\<forall>rv. ccap_relation rv (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + irqa * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)\<rbrace> \<inter> \<lbrace>irqa = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr} \<inter> (if irqa < 0x100 then UNIV else {})}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> ({s. rv = irqstate.IRQTimer \<longrightarrow> s \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV}}} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>} \<inter> {s. rv = irqstate.IRQReserved \<longrightarrow> s \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV} \<inter> {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> True} \<inter> \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQReserved\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQTimer\<rbrace> \<inter> - \<lbrace>\<acute>intStateIRQTable.[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal\<rbrace>}))})} proof (prove)
goal (1 subgoal):
 1. \<And>irqa s s'. \<lbrakk>irqa = UCAST(10 \<rightarrow> 32) irq; (s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq \<longrightarrow> irq \<le> UCAST(32 signed \<rightarrow> 10) Kernel_C.maxIRQ \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (irq_node' s + 2 ^ cte_level_bits * UCAST(10 \<rightarrow> 32) irq) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' s + 2 ^ cte_level_bits * UCAST(10 \<rightarrow> 32) irq) s)) \<and> UCAST(10 \<rightarrow> 32) irq < 0xA0) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQTimer \<longrightarrow> UCAST(10 \<rightarrow> 32) irq < 0xA0) \<and> (intStateIRQTable (ksInterruptState s) irq = irqstate.IRQReserved \<longrightarrow> UCAST(10 \<rightarrow> 32) irq < 0xA0)) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) Kernel_C.maxIRQ < UCAST(10 \<rightarrow> 32) irq \<longrightarrow> (\<forall>rv. intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv \<longrightarrow> (rv = irqstate.IRQSignal \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) s) \<longrightarrow> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> UCAST(10 \<rightarrow> 32) irq < 0x100) \<and> (rv = irqstate.IRQTimer \<longrightarrow> Kernel_C.IRQTimer \<noteq> Kernel_C.IRQSignal) \<and> (rv = irqstate.IRQReserved \<longrightarrow> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQTimer \<and> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQSignal))) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> (\<not> 159 < uint irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> cte_wp_at' (\<lambda>_. True) (irq_node' s + 2 ^ cte_level_bits * UCAST(10 \<rightarrow> 32) irq) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' s + 2 ^ cte_level_bits * UCAST(10 \<rightarrow> 32) irq) s)) \<and> (\<not> 159 < uint irq \<longrightarrow> (\<forall>rv. intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv \<longrightarrow> (rv = irqstate.IRQSignal \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) s) \<longrightarrow> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr) \<and> (rv = irqstate.IRQTimer \<longrightarrow> Kernel_C.IRQTimer \<noteq> Kernel_C.IRQSignal) \<and> (rv = irqstate.IRQReserved \<longrightarrow> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQTimer \<and> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQSignal))) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<not> 159 < uint irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal \<longrightarrow> cte_wp_at' (\<lambda>_. True) (irq_node' s + 2 ^ cte_level_bits * UCAST(10 \<rightarrow> 32) irq) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (irq_node' s + 2 ^ cte_level_bits * UCAST(10 \<rightarrow> 32) irq) s)
 2. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<not> 159 < uint irq \<longrightarrow> (\<forall>rv. intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv \<longrightarrow> (rv = irqstate.IRQSignal \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) s) \<longrightarrow> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr) \<and> (rv = irqstate.IRQTimer \<longrightarrow> Kernel_C.IRQTimer \<noteq> Kernel_C.IRQSignal) \<and> (rv = irqstate.IRQReserved \<longrightarrow> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQTimer \<and> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQSignal)) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<not> 159 < uint irq \<longrightarrow> (\<forall>rv. intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv \<longrightarrow> (rv = irqstate.IRQSignal \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) s) \<longrightarrow> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr) \<and> (rv = irqstate.IRQTimer \<longrightarrow> Kernel_C.IRQTimer \<noteq> Kernel_C.IRQSignal) \<and> (rv = irqstate.IRQReserved \<longrightarrow> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQTimer \<and> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQSignal)) proof (prove)
using this:
(unat irq \<le> unat local.maxIRQ) = (uint irq \<le> uint local.maxIRQ)

goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> \<not> 159 < uint irq \<longrightarrow> (\<forall>rv. intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv \<longrightarrow> (rv = irqstate.IRQSignal \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) s) \<longrightarrow> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr) \<and> (rv = irqstate.IRQTimer \<longrightarrow> Kernel_C.IRQTimer \<noteq> Kernel_C.IRQSignal) \<and> (rv = irqstate.IRQReserved \<longrightarrow> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQTimer \<and> Kernel_C.IRQReserved \<noteq> Kernel_C.IRQSignal)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv\<rbrakk> \<Longrightarrow> (rv = irqstate.IRQSignal \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)) \<longrightarrow> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr) \<and> (rv = irqstate.IRQReserved \<longrightarrow> Kernel_C.IRQReserved \<noteq> 2 \<and> Kernel_C.IRQReserved \<noteq> 1) proof (prove)
goal (5 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (\<forall>p b send. (\<exists>d. rv = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa rva cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; (sa, s') \<in> rf_sr; ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (\<forall>p b send. (\<exists>d. rva = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rva \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa rva cte y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))); ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>p b send. (\<exists>d. rva = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = b \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) \<noteq> 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))) = 0 \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rva \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa rva cte y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; ccap_relation rva (cte_C.cap_C y'); ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>p b send. (\<exists>d. rva = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C y')) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C y')) = b \<and> cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) \<noteq> 0 \<and> cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) = 0 \<and> cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)) \<and> (\<not> isNotificationCap rva \<longrightarrow> cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa rva cte y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; ccap_relation rva (cte_C.cap_C y'); ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))) = Some y'\<rbrakk> \<Longrightarrow> \<forall>p b send. (\<exists>d. rva = capability.NotificationCap p b send d) \<longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C y')) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C y')) = b \<and> isNotificationCap rva \<and> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) \<noteq> 0 \<and> isNotificationCap rva) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) = 0 \<and> isNotificationCap rva)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa cte y' p b send d. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; ccap_relation (capability.NotificationCap p b send d) (cte_C.cap_C y'); ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))) = Some y'\<rbrakk> \<Longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C y')) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C y')) = b \<and> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) \<noteq> 0) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) = 0)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa cte y' p b send d. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; ccap_relation (capability.NotificationCap p b send d) (cte_C.cap_C y'); ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))) = Some y'; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C y')) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C y')) = b \<and> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) \<noteq> 0) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) = 0)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (5 subgoals):
 1. \<And>s s' sa cte y' p b send d. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = SCAST(32 signed \<rightarrow> 32) Kernel_C.IRQSignal; ccap_relation (capability.NotificationCap p b send d) (cte_C.cap_C y'); ctes_of sa (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C)))) = Some y'; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; capability.NotificationCap p b send d = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C y'))) (capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C y'))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> (send \<longrightarrow> capNtfnPtr_CL (cap_notification_cap_lift (cte_C.cap_C y')) = p \<and> capNtfnBadge_CL (cap_notification_cap_lift (cte_C.cap_C y')) = b \<and> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) \<noteq> 0) \<and> (\<not> send \<longrightarrow> capNtfnCanSend_CL (cap_notification_cap_lift (cte_C.cap_C y')) = 0)
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 5. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (4 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) irq = 0 \<or> array_assertion intStateIRQNode_Ptr (unat irq) (hrs_htd (t_hrs_' (globals s')))
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 4. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQSignal; \<exists>s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s (symbol_table ''intStateIRQNode'' + UCAST(10 \<rightarrow> 32) irq * word_of_nat (size_of TYPE(cte_C))) = Some cte)\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 3. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal (2 subgoals):
 1. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 2
 2. \<And>s s' rv. \<lbrakk>(s, s') \<in> rf_sr; invs' s; unat irq \<le> 159; \<not> 159 < uint irq; intStateIRQTable_' (globals s').[unat irq] = irqstate_to_C rv; rv = irqstate.IRQReserved\<rbrakk> \<Longrightarrow> Kernel_C.IRQReserved \<noteq> 1 proof (prove)
goal:
No subgoals!