theory Interrupt_C

lemma decodeIRQHandlerInvocation_ccorres:
  notes if_cong[cong] gen_invocation_type_eq[simp]
  shows
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread)
              and ct_active' and sch_act_simple
              and (excaps_in_mem extraCaps o ctes_of)
              and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = IRQHandlerCap irq) slot s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s))
       (UNIV
            \<inter> {s. invLabel_' s = label}
            \<inter> {s. irq_' s = ucast irq}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}) []
     (decodeIRQHandlerInvocation label irq extraCaps
            >>= invocationCatch thread isBlocking isCall InvokeIRQHandler)
     (Call decodeIRQHandlerInvocation_'proc)" apply (cinit' lift: invLabel_' irq_' current_extra_caps_'
           simp: decodeIRQHandlerInvocation_def invocation_eq_use_types) apply (rule ccorres_Cond_rhs) apply (simp add: returnOk_bind ccorres_invocationCatch_Inr) apply (rule ccorres_rhs_assoc)+ apply (simp add: performInvocation_def bindE_assoc, simp add: liftE_bindE) apply (ctac(no_vcg) add: setThreadState_ccorres) apply (ctac(no_vcg) add: invokeIRQHandler_AckIRQ_ccorres) apply (simp add: liftE_alternative returnOk_liftE[symmetric]) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (wp sts_invs_minor')+ apply (rule ccorres_Cond_rhs) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (simp add: list_case_If2 split_def del: Collect_const) apply (rule ccorres_if_bind) apply (rule ccorres_if_lhs[rotated]) apply (rule ccorres_cond_false_seq) apply (simp add: Let_def split_def ntfn_case_can_send
                 del: Collect_const) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply (ctac(no_vcg)) apply (rule ccorres_assert) apply (rule_tac P="\<lambda>s. ksCurThread s = thread"
                    in ccorres_cross_over_guard) apply (csymbr | rule ccorres_Guard_Seq)+ apply (simp add: if_1_0_0 cap_get_tag_isCap del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: hd_conv_nth del: Collect_const) apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_bind invocationCatch_def) apply (simp add: throwError_def return_def) apply (simp add: syscall_error_rel_def syscall_error_to_H_cases) apply (simp add: exception_defs) apply (rule ccorres_rhs_assoc)+ apply csymbr+ apply (subgoal_tac "(capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0)
                              = (\<not> capNtfnCanSend rv)") apply (simp add: if_1_0_0 from_bool_0 hd_conv_nth del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_split_throws) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_bind invocationCatch_def) apply (simp add: throwError_def return_def) apply (simp add: syscall_error_rel_def syscall_error_to_H_cases) apply (simp add: exception_defs) apply vcg apply (simp add: hd_conv_nth liftE_bindE returnOk_bind
                         invocationCatch_def performInvocation_def
                         bind_assoc bind_bindE_assoc excaps_map_def
                    del: Collect_const) apply (ctac(no_vcg) add: setThreadState_ccorres) apply (ctac(no_vcg) add: invokeIRQHandler_SetIRQHandler_ccorres) apply (simp add: liftE_alternative returnOk_liftE[symmetric]) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (wp sts_invs_minor' hoare_vcg_ex_lift
                     | simp)+ apply (clarsimp simp: cap_get_tag_isCap[symmetric]
                      dest!: cap_get_tag_to_H) apply (simp add: to_bool_def) apply simp apply (simp add: getSlotCap_def) apply (wp getCTE_wp) apply (clarsimp simp: Collect_const_mem neq_Nil_conv
                    dest!: interpret_excaps_eq) apply (simp add: rf_sr_ksCurThread if_1_0_0 mask_def[where n=4]
                      "StrictC'_thread_state_defs" cap_get_tag_isCap excaps_map_def
                      word_sless_def word_sle_def) apply (simp add: invocationCatch_def throwError_bind
                     interpret_excaps_test_null Collect_True
                     excaps_map_def
                del: Collect_const
               cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (rule ccorres_Cond_rhs) apply (simp add: invocationCatch_def performInvocation_def
                     returnOk_bind liftE_bindE bind_assoc
                     bind_bindE_assoc bind_assoc) apply (rule ccorres_rhs_assoc)+ apply (ctac(no_vcg) add: setThreadState_ccorres) apply (ctac(no_vcg) add: invokeIRQHandler_ClearIRQHandler_ccorres) apply (simp add: liftE_alternative returnOk_liftE[symmetric]) apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (wp sts_invs_minor')+ apply (rule ccorres_equals_throwError) apply (fastforce simp: invocationCatch_def throwError_bind
                      split: gen_invocation_labels.split) apply (simp add: ccorres_cond_iffs cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply simp apply (clarsimp simp: Collect_const_mem tcb_at_invs') apply (clarsimp simp: invs_queues invs_valid_objs'
                        ct_in_state'_def
                        ccap_rights_relation_def
                        mask_def[where n=4]
                        "StrictC'_thread_state_defs") apply (subst pred_tcb'_weakenE, assumption, fastforce)+ apply (clarsimp simp: rf_sr_ksCurThread word_sle_def word_sless_def
    sysargs_rel_n_def word_less_nat_alt) apply (clarsimp simp: cte_wp_at_ctes_of neq_Nil_conv sysargs_rel_def n_msgRegisters_def
                    excaps_map_def excaps_in_mem_def word_less_nat_alt hd_conv_nth
                    slotcap_in_mem_def valid_tcb_state'_def
             dest!: interpret_excaps_eq split: bool.splits) apply (intro conjI impI allI) apply (clarsimp simp: cte_wp_at_ctes_of neq_Nil_conv sysargs_rel_def n_msgRegisters_def
                    excaps_map_def excaps_in_mem_def word_less_nat_alt hd_conv_nth
                    slotcap_in_mem_def valid_tcb_state'_def
             dest!: interpret_excaps_eq split: bool.splits)+ apply (auto dest: st_tcb_at_idle_thread' ctes_of_valid')[4] apply (drule ctes_of_valid') apply fastforce apply (clarsimp simp add:valid_cap_simps' ARM.maxIRQ_def) apply (erule order.trans,simp) apply (auto dest: st_tcb_at_idle_thread' ctes_of_valid') done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) (UNIV \<inter> \<lbrace>\<acute>invLabel = label\<rbrace> \<inter> \<lbrace>\<acute>irq = UCAST(10 \<rightarrow> 32) irq\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace>) [] (decodeIRQHandlerInvocation label irq extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (Call decodeIRQHandlerInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2451 current_extra_caps irqa invLabel) (?Q'2451 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_AckIRQ_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI
FI)
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2451 current_extra_caps irqa invLabel s \<and> s' \<in> ?Q'2451 current_extra_caps irqa invLabel proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2457 current_extra_caps irqa invLabel) (?S2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_AckIRQ_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?Q2457 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?S2457 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2457 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2457 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeIRQHandler (AckIRQ irq));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_AckIRQ_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?Q2457 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?S2457 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2457 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2457 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation isBlocking isCall (Invocations_H.invocation.InvokeIRQHandler (AckIRQ irq));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_AckIRQ_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?Q2457 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?S2457 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2457 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2457 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
x <- InterruptDecls_H.invokeIRQHandler (AckIRQ irq);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_AckIRQ_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?Q2457 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?S2457 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2477 current_extra_caps irqa invLabel rv) (?Q'2491 rv xfdc) [SKIP] (do x <- InterruptDecls_H.invokeIRQHandler (AckIRQ irq);
liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()
od) (CALL invokeIRQHandler_AckIRQ_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> \<lbrace>?R2485 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q2477 current_extra_caps irqa invLabel\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2485 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2490 current_extra_caps irqa invLabel t rv}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)}
flex-flex pairs:
\<lambda>t rv. ?Q'2491 rv (xfdc t) \<equiv>\<^sup>? ?Q'2490 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv xfdca rva xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2527 current_extra_caps irqa invLabel rv xfdca rva) (?Q'2545 rv xfdca rva xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2540 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (AckIRQ irq) \<lbrace>?Q2527 current_extra_caps irqa invLabel rv xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> \<lbrace>?R2485 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and ?R2540 current_extra_caps irqa invLabel a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2485 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'2546 current_extra_caps irqa invLabel t rv ta rva}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)}
flex-flex pairs:
?Q'2546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'2545 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel xfdca xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2527 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label () xfdca ()) (?Q'2545 () xfdca () xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2540 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (AckIRQ irq) \<lbrace>?Q2527 current_extra_caps irqa invLabel rv xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> \<lbrace>?R2485 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and ?R2540 current_extra_caps irqa invLabel a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2485 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'2546 current_extra_caps irqa invLabel t rv ta rva}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)}
flex-flex pairs:
?Q'2546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'2545 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel xfdca xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2527 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label () xfdca ()) (?Q'2545 () xfdca () xfdc) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2540 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (AckIRQ irq) \<lbrace>?Q2527 current_extra_caps irqa invLabel rv xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> \<lbrace>?R2485 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and ?R2540 current_extra_caps irqa invLabel a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2485 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'2546 current_extra_caps irqa invLabel t rv ta rva}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)}
flex-flex pairs:
?Q'2546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'2545 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2540 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (AckIRQ irq) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> \<lbrace>?R2485 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and ?R2540 current_extra_caps irqa invLabel a\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R2485 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2457 current_extra_caps irqa invLabel) (?T2457 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler THEN
  lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI
FI)
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> ?R2457 current_extra_caps irqa invLabel s)) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> ?T2457 current_extra_caps irqa invLabel)} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2605 current_extra_caps irqa invLabel) (?S2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
lvar_nondet_init slot_' slot_'_update;;
IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
\<acute>slot :== excaprefs_C current_extra_caps.[0];;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?Q2605 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?S2605 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2605 current_extra_caps irqa invLabel) (?S2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (lvar_nondet_init ntfnCap_' ntfnCap_'_update;;
(lvar_nondet_init slot_' slot_'_update;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C current_extra_caps.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?Q2605 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?S2605 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2605 current_extra_caps irqa invLabel) (?G'2630 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (lvar_nondet_init slot_' slot_'_update;;
(IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C current_extra_caps.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?Q2605 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> ?G'2630 current_extra_caps irqa invLabel}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2605 current_extra_caps irqa invLabel) (?G'2641 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C current_extra_caps.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C current_extra_caps.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(irqa,\<acute>ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?Q2605 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> ?G'2641 current_extra_caps irqa invLabel}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2605 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?G'2641 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] ((if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage else case fst (hd extraCaps) of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?Q2605 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> ?G'2641 current_extra_caps irqa invLabel}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2605 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?G'2641 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (if extraCaps = [] then throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler else (case fst (hd extraCaps) of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?Q2605 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> ?G'2641 current_extra_caps irqa invLabel}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2662 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?T2664 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] ((case fst (hd extraCaps) of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ?R2662 current_extra_caps irqa invLabel s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> ?T2664 current_extra_caps irqa invLabel)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2662 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?R'2673 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] ((case fst (hd extraCaps) of capability.NotificationCap x xa bool1 xb \<Rightarrow> case bool1 of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ?R2662 current_extra_caps irqa invLabel s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> ?R'2673 current_extra_caps irqa invLabel \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2662 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?R'2673 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ?R2662 current_extra_caps irqa invLabel s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> ?R'2673 current_extra_caps irqa invLabel \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P2690 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?R'2673 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
(if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P2690 current_extra_caps irqa invLabel s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> ?R'2673 current_extra_caps irqa invLabel \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A2697 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?C'2694 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
(if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler
od) (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A2697 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> ?C'2694 current_extra_caps irqa invLabel \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv ntfnCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2704 current_extra_caps irqa invLabel rv) (?Q'2704 current_extra_caps irqa invLabel rv ntfnCap) [SKIP] (do _ <- assert (rv = fst (extraCaps ! 0));
(if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler
od) (\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q2704 current_extra_caps irqa invLabel\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2704 current_extra_caps irqa invLabel rv (ntfnCap_' s)
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv ntfnCap; rv = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2704 current_extra_caps irqa invLabel rv) (?Q'2704 current_extra_caps irqa invLabel rv ntfnCap) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q2704 current_extra_caps irqa invLabel\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2704 current_extra_caps irqa invLabel rv (ntfnCap_' s)
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv ntfnCap; rv = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3024 current_extra_caps irqa invLabel rv) (?Q3022 current_extra_caps irqa invLabel rv ntfnCap) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,\<acute>slot);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and ?P'3024 current_extra_caps irqa invLabel a\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> ?Q3022 current_extra_caps irqa invLabel rv (ntfnCap_' s)}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3024 current_extra_caps irqa invLabel rv) (?G'3435 current_extra_caps irqa invLabel rv ntfnCap ret__unsigned) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and ?P'3024 current_extra_caps irqa invLabel a\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> ?G'3435 current_extra_caps irqa invLabel rv (ntfnCap_' s) v}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3024 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?G'3435 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF \<not> isNotificationCap (fst (extraCaps ! 0)) THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and ?P'3024 current_extra_caps irqa invLabel a\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> ?G'3435 current_extra_caps irqa invLabel rv (ntfnCap_' s) v}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3547 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?S3550 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> ?Q3547 current_extra_caps irqa invLabel a b) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> ?S3550 current_extra_caps irqa invLabel rv (ntfnCap_' s) v) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3547 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?S3550 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] (throwError (Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> ?Q3547 current_extra_caps irqa invLabel a b) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> ?S3550 current_extra_caps irqa invLabel rv (ntfnCap_' s) v) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3547 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?R'3565 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] (throwError (Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> ?Q3547 current_extra_caps irqa invLabel a b) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> ?R'3565 current_extra_caps irqa invLabel rv (ntfnCap_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (8 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3570 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((throwError (Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 5. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'3570 current_extra_caps irqa invLabel rv (ntfnCap_' s) v \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 8. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((throwError (Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. ret__unsigned_' t = cap_get_tag ntfnCap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((throwError (Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (current_syscall_error_' (globals s))))) (s\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (current_syscall_error_' (globals s))))) (s\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>)))}
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnCap \<sigma> x t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0)); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (invalidCapNumber_C_update (\<lambda>_. 0) (current_syscall_error_' (globals x))))) (x\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnCap \<sigma> x t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0)); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_rel (Fault_H.syscall_error.InvalidCapability 0) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (errstate (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (invalidCapNumber_C_update (\<lambda>_. 0) (current_syscall_error_' (globals x))))) (x\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnCap \<sigma> x t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; \<not> isNotificationCap (fst (extraCaps ! 0)); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigned = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T3548 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap)) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> ?T3548 current_extra_caps irqa invLabel rv (ntfnCap_' s) v)}}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?G'3851 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) ret__unsigned) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF (if ret__unsigned = 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> ?G'3851 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?G'3851 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) ret__unsigned) [SKIP] ((if isNotificationCap (fst (hd extraCaps)) then case capNtfnCanSend (fst (hd extraCaps)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 else throwError (Fault_H.syscall_error.InvalidCapability 0)) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF (if ret__unsigned = 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> ?G'3851 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0)))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3546 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?G'3851 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF \<not> capNtfnCanSend (fst (extraCaps ! 0)) THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> ?R3546 current_extra_caps irqa invLabel a b))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> ?G'3851 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (8 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4041 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?S4044 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> ?Q4041 current_extra_caps irqa invLabel a b) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 5. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?S4044 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 8. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (9 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4041 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?P'4052 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> ?Q4041 current_extra_caps irqa invLabel a b) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?P'4052 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (9 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},{s. \<exists>(rv, \<sigma>')\<in>fst (((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (9 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. ret__unsigned_' t = cap_get_tag ntfnCap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (current_syscall_error_' (globals s))))) (s\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. invalidCapNumber_C_update (\<lambda>_. 0) (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (current_syscall_error_' (globals s))))) (s\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>)))}
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnCap \<sigma> x t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0; \<not> capNtfnCanSend (fst (extraCaps ! 0)); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (throwError (Inl (Fault_H.syscall_error.InvalidCapability 0)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (invalidCapNumber_C_update (\<lambda>_. 0) (current_syscall_error_' (globals x))))) (x\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnCap \<sigma> x t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0; \<not> capNtfnCanSend (fst (extraCaps ! 0)); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_rel (Fault_H.syscall_error.InvalidCapability 0) (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (errstate (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) (invalidCapNumber_C_update (\<lambda>_. 0) (current_syscall_error_' (globals x))))) (x\<lparr>ret__unsigned_' := cap_get_tag ntfnCap\<rparr>)))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnCap \<sigma> x t. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; isNotificationCap (fst (extraCaps ! 0)); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0; \<not> capNtfnCanSend (fst (extraCaps ! 0)); (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_get_tag ntfnCap\<rbrakk> \<Longrightarrow> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (8 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4051 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) \<acute>ret__unsigned :== CALL cap_get_capType_'proc(ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 5. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> ?R'4051 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 8. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0))); \<not> \<not> capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] ((case capNtfnCanSend (fst (extraCaps ! 0)) of True \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq (fst (hd extraCaps)) (snd (hd extraCaps)) | False \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (7 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4040 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))) (?T4042 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) [SKIP] (do y <- setThreadState Structures_H.thread_state.Restart thread;
rv <- InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0)));
liftE (replyOnRestart thread [] isCall \<sqinter> return ())
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ?R4040 current_extra_caps irqa invLabel a b)))\<rbrace>
 4. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> ?T4042 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va)}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 7. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (8 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0)); dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4133 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva) (?Q'4147 ntfnCap rva xfdc) [SKIP] (do rv <- InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0)));
liftE (replyOnRestart thread [] isCall \<sqinter> return ())
od) (CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,ntfnCap,excaprefs_C extraCaps'.[0]);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4141 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4133 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4141 current_extra_caps irqa invLabel a) b)))\<rbrace>
 5. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'4146 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va t rva})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 8. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})}
flex-flex pairs:
\<lambda>ntfnCap t rv. ?Q'4147 ntfnCap rv (xfdc t) \<equiv>\<^sup>? \<lambda>ntfnCap. ?Q'4146 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)) proof (prove)
goal (9 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdca rvb xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0)); dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4191 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdca rvb) (?Q'4209 ntfnCap rva xfdca rvb xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall \<sqinter> return ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0)); dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) \<lbrace>?Q4191 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4141 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and irq_handler_inv_valid' (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) and ?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4141 current_extra_caps irqa invLabel a) b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4210 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va t rva ta rvb}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})}
flex-flex pairs:
\<lambda>ntfnCap. ?Q'4210 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)) \<equiv>\<^sup>? \<lambda>ntfnCap t rv ta rva. ?Q'4209 ntfnCap rv (xfdc t) rva (xfdc ta) proof (prove)
goal (9 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned xfdca xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4191 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)) () xfdca ()) (?Q'4209 ntfnCap () xfdca () xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0)); dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) \<lbrace>?Q4191 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4141 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and irq_handler_inv_valid' (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) and ?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4141 current_extra_caps irqa invLabel a) b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4210 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va t rva ta rvb}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})}
flex-flex pairs:
\<lambda>ntfnCap. ?Q'4210 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)) \<equiv>\<^sup>? \<lambda>ntfnCap t rv ta rva. ?Q'4209 ntfnCap rv (xfdc t) rva (xfdc ta) proof (prove)
goal (9 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned xfdca xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4191 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)) () xfdca ()) (?Q'4209 ntfnCap () xfdca () xfdc) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0)); dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) \<lbrace>?Q4191 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4141 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and irq_handler_inv_valid' (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) and ?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4141 current_extra_caps irqa invLabel a) b)))\<rbrace>
 6. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>va v'. va = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := va\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if va = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4210 current_extra_caps irqa invLabel rv (ntfnCap_' s) v va t rva ta rvb}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 8. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 9. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})}
flex-flex pairs:
\<lambda>ntfnCap. ?Q'4210 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0)) ntfnCap (cap_get_tag ntfnCap) (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)) \<equiv>\<^sup>? \<lambda>ntfnCap t rv ta rva. ?Q'4209 ntfnCap rv (xfdc t) rva (xfdc ta) proof (prove)
goal (8 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva xfdc. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0)); dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned rva\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap); capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) \<noteq> 0; capNtfnCanSend (fst (extraCaps ! 0))\<rbrakk> \<Longrightarrow> \<lbrace>?R4141 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label (fst (extraCaps ! 0))\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and irq_handler_inv_valid' (irqhandler_invocation.SetIRQHandler irq (fst (extraCaps ! 0)) (snd (extraCaps ! 0))) and ?R4204 current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned a\<rbrace>
 3. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; \<not> \<not> isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend rv)
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4141 current_extra_caps irqa invLabel a) b)))\<rbrace>
 5. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 6. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 7. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 8. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv ntfnCap ret__unsigneda ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation (fst (extraCaps ! 0)) ntfnCap; rv = fst (extraCaps ! 0); ret__unsigneda = cap_get_tag ntfnCap; isNotificationCap (fst (extraCaps ! 0)); ret__unsigned = capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> capNtfnCanSend (fst (extraCaps ! 0)))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> valid_cap' a b \<and> valid_cap' (capability.IRQHandlerCap irq) b \<and> cte_wp_at' (badge_derived' a \<circ> cteCap) (snd (extraCaps ! 0)) b \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x b) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) b)) b)))\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (6 subgoals):
 1. \<And>ntfnCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; cap_get_tag ntfnCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; fst (extraCaps ! 0) = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift ntfnCap)) (capNtfnBadge_CL (cap_notification_cap_lift ntfnCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift ntfnCap)))\<rbrakk> \<Longrightarrow> (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap) = 0) = (\<not> to_bool (capNtfnCanSend_CL (cap_notification_cap_lift ntfnCap)))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> valid_cap' a b \<and> valid_cap' (capability.IRQHandlerCap irq) b \<and> cte_wp_at' (badge_derived' a \<circ> cteCap) (snd (extraCaps ! 0)) b \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x b) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) b)) b)))\<rbrace>
 3. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 5. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 6. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a. (\<lambda>s. ksCurThread s = thread) and (\<lambda>b. (\<not> isNotificationCap a \<longrightarrow> True) \<and> (\<not> \<not> isNotificationCap a \<longrightarrow> (\<not> capNtfnCanSend a \<longrightarrow> True) \<and> (\<not> \<not> capNtfnCanSend a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> valid_cap' a b \<and> valid_cap' (capability.IRQHandlerCap irq) b \<and> cte_wp_at' (badge_derived' a \<circ> cteCap) (snd (extraCaps ! 0)) b \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x b) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) b)) b)))\<rbrace>
 2. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>a b. ksCurThread b = thread \<and> (isNotificationCap a \<longrightarrow> capNtfnCanSend a \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> valid_cap' a b \<and> valid_cap' (capability.IRQHandlerCap irq) b \<and> cte_wp_at' (\<lambda>b. badge_derived' a (cteCap b)) (snd (extraCaps ! 0)) b \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x b) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) b)\<rbrace>
 2. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?R2709 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> do cte <- getCTE (snd (extraCaps ! 0));
return (cteCap cte)
od \<lbrace>\<lambda>a b. ksCurThread b = thread \<and> (isNotificationCap a \<longrightarrow> capNtfnCanSend a \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> valid_cap' a b \<and> valid_cap' (capability.IRQHandlerCap irq) b \<and> cte_wp_at' (\<lambda>b. badge_derived' a (cteCap b)) (snd (extraCaps ! 0)) b \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x b) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) b)\<rbrace>
 2. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R2709 current_extra_caps irqa invLabel and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel s rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps \<noteq> []; ccap_relation rv (ntfnCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> ksCurThread sa = thread \<longrightarrow> s' \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0\<rparr> \<in> {sa. (\<not> isNotificationCap rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> \<not> isNotificationCap rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = capNtfnCanSend_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. sa\<lparr>ret__int_' := if v = 0 then 1 else 0\<rparr> \<in> {sa. (\<not> capNtfnCanSend rv \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> capNtfnCanSend rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. slot_'_update (\<lambda>x. excaprefs_C current_extra_caps.[0]) (cap_'_update (\<lambda>_. ntfnCap_' s) (irq_'_update (\<lambda>_. irqa) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}})}}}} \<inter> {sa. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ntfnCap_' s) sa)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap})}}}}}
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (4 subgoals):
 1. \<And>s rv a b ys sa. \<lbrakk>gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; ccap_relation rv (ntfnCap_' s); \<forall>n<length (excaps_map ((a, b) # ys)). excaprefs_C extraCaps'.[n] = excaps_map ((a, b) # ys) ! n \<and> (length (excaps_map ((a, b) # ys)) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (excaps_map ((a, b) # ys))] = NULL); extraCaps = (a, b) # ys; (sa, s) \<in> rf_sr; thread = ksCurThread sa\<rbrakk> \<Longrightarrow> (\<not> isNotificationCap rv \<longrightarrow> cap_get_tag (ntfnCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<and> (isNotificationCap rv \<longrightarrow> (capNtfnCanSend rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr (ksCurThread sa) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr b) \<and> cap_get_tag (ntfnCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap)
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError Fault_H.syscall_error.TruncatedMessage >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF excaprefs_C extraCaps'.[0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability) \<acute>current_syscall_error;;
\<acute>current_syscall_error :== invalidCapNumber_C_update (\<lambda>_. 0) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = []; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2663 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S2666 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError (Inl Fault_H.syscall_error.TruncatedMessage)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>ntfnCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>slot :== excaprefs_C extraCaps'.[0];;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(\<acute>ntfnCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>ntfnCap);;
\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_InvalidCapability));;
\<acute>globals :== current_syscall_error_'_update (invalidCapNumber_C_update (\<lambda>_. 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_SetIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq,\<acute>ntfnCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> ?Q2663 current_extra_caps irqa invLabel s) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> ?S2666 current_extra_caps irqa invLabel) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel err' ft'. \<lbrakk>interpret_excaps extraCaps' = []; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; extraCaps = []\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) err') ft' = Some Fault_H.syscall_error.TruncatedMessage
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R2605 current_extra_caps irqa invLabel) (?T2605 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (IF gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler THEN
  CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
ELSE
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI)
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> ?R2605 current_extra_caps irqa invLabel s))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> ?T2605 current_extra_caps irqa invLabel)})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4350 current_extra_caps irqa invLabel) (?S4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(irqa);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?Q4350 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?S4350 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4350 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S4350 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do y <- setThreadState Structures_H.thread_state.Restart thread;
rv <- InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq);
liftE (replyOnRestart thread [] isCall \<sqinter> return ())
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL invokeIRQHandler_ClearIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?Q4350 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?S4350 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4350 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?S4350 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (do y <- setThreadState Structures_H.thread_state.Restart thread;
rv <- InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq);
liftE (replyOnRestart thread [] isCall \<sqinter> return ())
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL invokeIRQHandler_ClearIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?Q4350 current_extra_caps irqa invLabel s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?S4350 current_extra_caps irqa invLabel) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4376 current_extra_caps irqa invLabel rv) (?Q'4390 rv xfdc) [SKIP] (do rv <- InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq);
liftE (replyOnRestart thread [] isCall \<sqinter> return ())
od) (CALL invokeIRQHandler_ClearIRQHandler_'proc(UCAST(10 \<rightarrow> 32) irq);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R4384 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q4376 current_extra_caps irqa invLabel\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4384 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'4389 current_extra_caps irqa invLabel t rv}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})}
flex-flex pairs:
\<lambda>t rv. ?Q'4390 rv (xfdc t) \<equiv>\<^sup>? ?Q'4389 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv xfdca rva xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4426 current_extra_caps irqa invLabel rv xfdca rva) (?Q'4444 rv xfdca rva xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall \<sqinter> return ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq) \<lbrace>?Q4426 current_extra_caps irqa invLabel rv xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R4384 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and K (irq \<le> 0xFF) and ?R4439 current_extra_caps irqa invLabel a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4384 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4445 current_extra_caps irqa invLabel t rv ta rva}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})}
flex-flex pairs:
?Q'4445 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'4444 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel xfdca xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4426 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label () xfdca ()) (?Q'4444 () xfdca () xfdc) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq) \<lbrace>?Q4426 current_extra_caps irqa invLabel rv xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R4384 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and K (irq \<le> 0xFF) and ?R4439 current_extra_caps irqa invLabel a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4384 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4445 current_extra_caps irqa invLabel t rv ta rva}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})}
flex-flex pairs:
?Q'4445 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'4444 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (5 subgoals):
 1. \<And>current_extra_caps irqa invLabel xfdca xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4426 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label () xfdca ()) (?Q'4444 () xfdca () xfdc) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq) \<lbrace>?Q4426 current_extra_caps irqa invLabel rv xfdc\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R4384 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and K (irq \<le> 0xFF) and ?R4439 current_extra_caps irqa invLabel a\<rbrace>
 4. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 5. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4384 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'4445 current_extra_caps irqa invLabel t rv ta rva}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})}
flex-flex pairs:
?Q'4445 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label \<equiv>\<^sup>? \<lambda>t rv ta rva. ?Q'4444 rv (xfdc t) rva (xfdc ta) proof (prove)
goal (4 subgoals):
 1. \<And>current_extra_caps irqa invLabel rv xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4439 current_extra_caps irqa invLabel rv\<rbrace> InterruptDecls_H.invokeIRQHandler (irqhandler_invocation.ClearIRQHandler irq) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R4384 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and K (irq \<le> 0xFF) and ?R4439 current_extra_caps irqa invLabel a\<rbrace>
 3. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 4. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R4384 current_extra_caps irqa invLabel) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] ((case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> K (irq \<le> 0xFF) a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (3 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> (case gen_invocation_type label of gen_invocation_labels.IRQAckIRQ \<Rightarrow> returnOk $ AckIRQ irq | gen_invocation_labels.IRQSetIRQHandler \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (cap, slot) # x \<Rightarrow> case cap of capability.NotificationCap x xa True xb \<Rightarrow> returnOk $ irqhandler_invocation.SetIRQHandler irq cap slot | capability.NotificationCap x xa False xb \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | gen_invocation_labels.IRQClearIRQHandler \<Rightarrow> returnOk $ irqhandler_invocation.ClearIRQHandler irq | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeIRQHandler = throwError (?v4520 current_extra_caps irqa invLabel)
 2. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] (throwError (?v4520 current_extra_caps irqa invLabel)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 3. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> K (irq \<le> 0xFF) a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 current_extra_caps irqa invLabel) (?T4350 current_extra_caps irqa invLabel) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> K (irq \<le> 0xFF) a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4350 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) (?T4350 extraCaps' (UCAST(10 \<rightarrow> 32) irq) label) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR))
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> K (irq \<le> 0xFF) a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ?R4350 current_extra_caps irqa invLabel s)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> ?T4350 current_extra_caps irqa invLabel)})})} proof (prove)
goal (2 subgoals):
 1. \<And>current_extra_caps irqa invLabel err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label \<noteq> gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> K (irq \<le> 0xFF) a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> True)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> UNIV)})})} proof (prove)
goal (1 subgoal):
 1. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s)) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (extraCaps = [] \<longrightarrow> True) \<and> (extraCaps \<noteq> [] \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) a \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) a \<and> ksCurThread a = thread \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> valid_cap' (cteCap cte) a \<and> valid_cap' (capability.IRQHandlerCap irq) a \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) a \<and> (\<exists>x. cte_wp_at' (\<lambda>a. cteCap a = capability.IRQHandlerCap irq) x a) \<and> ex_cte_cap_wp_to' isCNodeCap (snd (extraCaps ! 0)) a))) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C current_extra_caps.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)) s)) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') a \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> K (irq \<le> 0xFF) a \<and> True)) s) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> True)))) \<and> s' \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. \<forall>v. ntfnCap_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. slot_'_update (\<lambda>_. v) s \<in> {s. (extraCaps = [] \<longrightarrow> s \<in> UNIV) \<and> (extraCaps \<noteq> [] \<longrightarrow> s \<in> \<lbrace>excaprefs_C current_extra_caps.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> - \<lbrace>excaprefs_C current_extra_caps.[0] = NULL\<rbrace>)}}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> s \<in> {s. (gen_invocation_type invLabel = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. irq_'_update (\<lambda>_. irqa) s \<in> UNIV \<inter> \<lbrace>\<acute>irq = irqa\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc rv (K rv (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>}}) \<and> (gen_invocation_type invLabel \<noteq> gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> s \<in> UNIV)})})} proof (prove)
goal (1 subgoal):
 1. \<And>current_extra_caps irqa invLabel s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; current_extra_caps = extraCaps'; irqa = UCAST(10 \<rightarrow> 32) irq; invLabel = label; (s, s') \<in> rf_sr; invs' s \<and> ksCurThread s = thread \<and> ct_active' s \<and> sch_act_simple s \<and> excaps_in_mem extraCaps (ctes_of s) \<and> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s) \<and> (\<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s); current_extra_caps_' (globals s') = extraCaps'\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> (obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> (obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> (obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> irq \<le> 0xFF)) \<and> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> (\<forall>v va. slot_'_update (\<lambda>_. va) (ntfnCap_'_update (\<lambda>_. v) s') \<in> (if excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> slot_'_update (\<lambda>_. va) (ntfnCap_'_update (\<lambda>_. v) s') \<notin> (if excaprefs_C extraCaps'.[0] = NULL then UNIV else {}))) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' slot. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> irq \<le> 0xFF)) \<and> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' slot. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> st_tcb_at' runnable' (ksCurThread s) s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> irq \<le> 0xFF)) \<and> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' slot. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> True \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> True)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> True \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> True) \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> True \<and> (obj_at' tcbQueued (ksCurThread s) s \<longrightarrow> True) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> irq \<le> 0xFF)) \<and> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' slot. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.IRQHandlerCap irq) slot s\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! 0)) s \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (snd (extraCaps ! 0)) s \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> cte_wp_at' (\<lambda>a. badge_derived' (cteCap cte) (cteCap a)) (snd (extraCaps ! 0)) s))) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> irq \<le> 0xFF)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> extraCaps \<noteq> [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) proof (prove)
goal (1 subgoal):
 1. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQAckIRQ \<longrightarrow> sch_act_wf (ksSchedulerAction s) s) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> (gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (\<exists>a b ys. extraCaps = (a, b) # ys) \<longrightarrow> (\<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte \<and> cteCap cte = fst (extraCaps ! 0)) \<longrightarrow> ((\<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte) \<longrightarrow> (\<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> sch_act_wf (ksSchedulerAction s) s \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> (\<exists>ctea. ctes_of s (snd (extraCaps ! 0)) = Some ctea \<and> badge_derived' (cteCap cte) (cteCap ctea))))) \<and> (\<exists>cte. ctes_of s (ptr_val (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x)) = Some cte)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler \<longrightarrow> sch_act_wf (ksSchedulerAction s) s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> irq \<le> 0xFF)) \<and> (gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ \<longrightarrow> gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler \<longrightarrow> (\<exists>a b ys. extraCaps = (a, b) # ys) \<longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0)) \<and> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL) proof (prove)
goal (8 subgoals):
 1. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label = gen_invocation_labels.IRQAckIRQ\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) s
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys; \<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte \<and> cteCap cte = fst (extraCaps ! 0); \<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte \<and> (isNotificationCap (cteCap cte) \<longrightarrow> capNtfnCanSend (cteCap cte) \<longrightarrow> sch_act_wf (ksSchedulerAction s) s \<and> valid_cap' (cteCap cte) s \<and> valid_cap' (capability.IRQHandlerCap irq) s \<and> (\<exists>ctea. ctes_of s (snd (extraCaps ! 0)) = Some ctea \<and> badge_derived' (cteCap cte) (cteCap ctea)))
 3. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys; \<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte \<and> cteCap cte = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (ptr_val (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x)) = Some cte
 4. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) s
 5. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 6. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> irq \<le> 0xFF
 7. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 8. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (7 subgoals):
 1. \<And>s s' slot cte ctea b ys. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set ys. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>n<Suc (length ys). excaprefs_C (current_extra_caps_' (globals s')).[n] = (case ((cteCap ctea, b) # ys) ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length ys < 2 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (length ys)] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; ctes_of s b = Some ctea; extraCaps = (cteCap ctea, b) # ys; ex_cte_cap_wp_to' isCNodeCap b s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; isNotificationCap (cteCap ctea); capNtfnCanSend (cteCap ctea)\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) s \<and> valid_cap' (cteCap ctea) s \<and> valid_cap' (capability.IRQHandlerCap irq) s
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys; \<exists>cte. ctes_of s (snd (extraCaps ! 0)) = Some cte \<and> cteCap cte = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (ptr_val (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x)) = Some cte
 3. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> sch_act_wf (ksSchedulerAction s) s
 4. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> weak_sch_act_wf (ksSchedulerAction s) s
 5. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> irq \<le> 0xFF
 6. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 7. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (3 subgoals):
 1. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> irq \<le> 0xFF
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 3. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (4 subgoals):
 1. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> irq \<le> 0xFF
 3. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 4. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (3 subgoals):
 1. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label \<noteq> gen_invocation_labels.IRQSetIRQHandler; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> irq \<le> 0xFF
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 3. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label = gen_invocation_labels.IRQClearIRQHandler; capAligned (capability.IRQHandlerCap irq); irq \<le> 0x9F\<rbrakk> \<Longrightarrow> irq \<le> 0xFF
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 3. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (2 subgoals):
 1. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! 0))
 2. \<And>s s' slot cte. \<lbrakk>(s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; \<forall>x\<in>set extraCaps. case x of (cp, slot) \<Rightarrow> \<exists>cte. ctes_of s slot = Some cte \<and> cp = cteCap cte; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; \<forall>n<length extraCaps. excaprefs_C (current_extra_caps_' (globals s')).[n] = (case extraCaps ! n of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (length extraCaps < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length extraCaps] = NULL); ctes_of s slot = Some cte; cteCap cte = capability.IRQHandlerCap irq; gen_invocation_type label \<noteq> gen_invocation_labels.IRQAckIRQ; gen_invocation_type label = gen_invocation_labels.IRQSetIRQHandler; \<exists>a b ys. extraCaps = (a, b) # ys\<rbrakk> \<Longrightarrow> (case extraCaps ! 0 of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal:
No subgoals!