theory Interrupt_DR

lemma decode_irq_control_corres:
  "\<lbrakk> Some (IrqControlIntent ui) = transform_intent (invocation_type label') args';
     cap = transform_cap cap';
     cap' = cap.IRQControlCap;
     slot = transform_cslot_ptr slot';
     excaps = transform_cap_list excaps' \<rbrakk> \<Longrightarrow>
   dcorres (dc \<oplus> cdl_irq_control_invocation_relation)
     \<top>
     (valid_objs and (\<lambda>s. \<forall>e \<in> set excaps'. valid_cap (fst e) s)
                 and valid_global_refs
                 and valid_idle
                 and valid_etcbs)
     (Interrupt_D.decode_irq_control_invocation cap slot excaps ui)
     (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps'))" apply (cases "invocation_type label' = GenInvocationLabel IRQIssueIRQHandler") subgoal  (* generic case *)
     apply (unfold Interrupt_D.decode_irq_control_invocation_def
                  Decode_A.decode_irq_control_invocation_def
                  arch_check_irq_def) apply clarsimp apply (simp add: transform_intent_def transform_intent_issue_irq_handler_def
                flip: gen_invocation_type_eq
                split: list.splits) apply (rule conjI) prefer 2 \<comment> \<open>error case\<close> apply clarsimp apply (rule corres_guard_imp) apply (rule dcorres_alternative_throw) apply (rule TrueI, rule TrueI) apply (clarsimp simp: Let_def) apply (rule dcorres_whenE_throwError_abstract') apply (rule corres_guard_imp, rule dcorres_alternative_throw) apply (rule TrueI, rule TrueI) apply (rule dcorres_symb_exec_rE) apply (rule dcorres_whenE_throwError_abstract') apply (rule corres_guard_imp) apply (rule dcorres_alternative_throw) apply (rule TrueI, rule TrueI) apply (simp add: get_index_def transform_cap_list_def throw_on_none_def) apply (cases "excaps' = []", simp_all) apply (rule corres_alternative_throw_splitE) apply (rule corres_alternate1) apply (rule lookup_slot_for_cnode_op_corres) apply simp+ apply (clarsimp simp: split_def,simp) apply (rule corres_throw_skip_r) apply (rule corres_alternate1) apply (rule corres_returnOk [where P=\<top> and P'=\<top>]) apply (simp add: cdl_irq_control_invocation_relation_def) apply wp[1] apply simp apply (wp+)[3] apply simp apply (rule hoare_pre, wp) apply simp apply wp apply (cases excaps', auto)[1] apply wp done apply (cases "invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler") subgoal  (* arch case *)
    apply (unfold Interrupt_D.decode_irq_control_invocation_def
                 Interrupt_D.arch_decode_irq_control_invocation_def
                 Decode_A.decode_irq_control_invocation_def
                 arch_decode_irq_control_invocation_def
                 arch_check_irq_def) apply clarsimp apply (simp add: transform_intent_def transform_intent_issue_irq_handler_def
                     arch_transform_intent_issue_irq_handler_def
                flip: gen_invocation_type_eq
                split: list.splits) apply (rule conjI) prefer 2 \<comment> \<open>error case\<close> apply clarsimp apply (rule corres_guard_imp) apply (rule dcorres_alternative_throw) apply (rule TrueI, rule TrueI) apply (clarsimp simp: Let_def) apply (rule dcorres_whenE_throwError_abstract') apply (rule corres_guard_imp, rule dcorres_alternative_throw) apply (rule TrueI, rule TrueI) apply (rule dcorres_symb_exec_rE) apply (rule dcorres_whenE_throwError_abstract') apply (rule corres_guard_imp) apply (rule dcorres_alternative_throw) apply (rule TrueI, rule TrueI) apply (simp add: get_index_def transform_cap_list_def throw_on_none_def) apply (cases "excaps' = []", simp_all) apply (rule corres_alternative_throw_splitE) apply (rule corres_alternate1) apply (rule lookup_slot_for_cnode_op_corres) apply simp+ apply (clarsimp simp: split_def,simp) apply (rule corres_throw_skip_r) apply (rule corres_alternate1) apply (rule corres_returnOk [where P=\<top> and P'=\<top>]) apply (simp add: cdl_irq_control_invocation_relation_def) apply wp[1] apply simp apply (wp+)[3] apply simp apply (rule hoare_pre, wp) apply simp apply wp apply (cases excaps', auto)[1] apply wp done subgoal  (* arch case *)
       apply (unfold Interrupt_D.decode_irq_control_invocation_def
                    Interrupt_D.arch_decode_irq_control_invocation_def
                    Decode_A.decode_irq_control_invocation_def
                    arch_decode_irq_control_invocation_def
                    arch_check_irq_def) apply clarsimp apply (cases ui; simp) apply (simp add: corres_alternate2 flip: gen_invocation_type_eq) apply(rename_tac ARMIRQControlIntent) apply (case_tac ARMIRQControlIntent; simp) apply (simp add: corres_alternate2 flip: gen_invocation_type_eq) done done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps'))
 2. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index excaps 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq slot dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent arch_intent \<Rightarrow> Interrupt_D.arch_decode_irq_control_invocation cap slot excaps arch_intent) (if gen_invocation_type label' = IRQIssueIRQHandler then if 3 \<le> length args' \<and> 1 \<le> length (map fst excaps') then let irq_word = args' ! 0; index = args' ! 1; depth = args' ! 2; cnode = map fst excaps' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) $ throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ));
irq_active <- liftE $ is_irq_active irq;
whenE irq_active $ throwError RevokeFirst;
dest_slot <- lookup_target_slot cnode (data_to_cptr index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ IRQControl irq dest_slot slot'
odE else throwError TruncatedMessage else liftME ArchIRQControl $ local.arch_decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (GenInvocationLabel IRQIssueIRQHandler) args'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent arch_intent \<Rightarrow> Interrupt_D.arch_decode_irq_control_invocation IrqControlCap (transform_cslot_ptr slot') (transform_cap_list excaps') arch_intent) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent x \<Rightarrow> Interrupt_D.arch_decode_irq_control_invocation IrqControlCap (transform_cslot_ptr slot') (transform_cap_list excaps') x) (local.arch_decode_irq_control_invocation label' args' slot' (map fst excaps')))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent arch_intent \<Rightarrow> Interrupt_D.arch_decode_irq_control_invocation IrqControlCap (transform_cslot_ptr slot') (transform_cap_list excaps') arch_intent) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent x \<Rightarrow> Interrupt_D.arch_decode_irq_control_invocation IrqControlCap (transform_cslot_ptr slot') (transform_cap_list excaps') x) (local.arch_decode_irq_control_invocation label' args' slot' (map fst excaps')))) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> (Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (\<not> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)
 2. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> \<not> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> \<not> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; \<not> Suc 0 \<le> length excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE) proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; \<not> Suc 0 \<le> length excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q58 x21 x21a x21b x22b) (?Q'58 x21 x21a x21b x22b) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; \<not> Suc 0 \<le> length excaps'; True\<rbrakk> \<Longrightarrow> ?Q58 x21 x21a x21b x22b s
 3. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; \<not> Suc 0 \<le> length excaps'; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'58 x21 x21a x21b x22b s
 4. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; \<not> Suc 0 \<le> length excaps'; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; \<not> Suc 0 \<le> length excaps'; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x21a x22a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; x22 = x21a # x21b # x22b; x22a = x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)))
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; UCAST(10 \<rightarrow> 32) maxIRQ < x21; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; UCAST(10 \<rightarrow> 32) maxIRQ < x21; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE y <- whenE rv (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError RevokeFirst)
 2. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)
 3. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 4. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q81 x21 x21a x21b x22b rv) (?Q'81 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError RevokeFirst)
 2. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; True\<rbrakk> \<Longrightarrow> ?Q81 x21 x21a x21b x22b rv s
 3. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; ?Q'74 x21 x21a x21b x22b rv s\<rbrakk> \<Longrightarrow> ?Q'81 x21 x21a x21b x22b rv s
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)
 5. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 6. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; ?Q'74 x21 x21a x21b x22b rv s\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)
 4. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 5. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b False) (doE dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b False) (throw \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False ([] ! 0) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE))
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b False) (doE dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) dest_slot slot')
odE)
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'91 x21 x21a x21b x22b rv) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b False) (CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<sqinter> throw) (CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b))
 2. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; ?r'91 x21 x21a x21b x22b rv x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot')
odE)
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'74 x21 x21a x21b x22b False\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 8. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'91 x21 x21a x21b x22b rv) (\<lambda>_. True) (?Q'74 x21 x21a x21b x22b False) (CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b)) (CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b))
 2. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; ?r'91 x21 x21a x21b x22b rv x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot')
odE)
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'74 x21 x21a x21b x22b False\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'74 x21 x21a x21b x22b\<rbrace>
 8. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> x21a = of_bl (to_bl x21a)
 2. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> length (to_bl x21a) = 32
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) = transform_cap (fst (excaps' ! 0))
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> unat x21b = unat x21b
 5. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot')
odE)
 6. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) = transform_cap (fst (excaps' ! 0))
 2. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> unat x21b = unat x21b
 3. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot')
odE)
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot')
odE)
 2. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 7. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot'))
 2. \<And>x21 x21a x21b x22b rv x x' s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (?Q'91 x21 x21a x21b x22b rv x') (CSpaceAcc_A.ensure_empty x')
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (?Q91 x21 x21a x21b x22b rv x) (?Q'91 x21 x21a x21b x22b rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x)) (returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot'))
 2. \<And>x21 x21a x21b x22b rv x x' s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (?Q'91 x21 x21a x21b x22b rv x') (CSpaceAcc_A.ensure_empty x')
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>?Q91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>?Q'91 x21 x21a x21b x22b rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'91 x21 x21a x21b x22b rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x22b rv x x' s s'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True; True\<rbrakk> \<Longrightarrow> cdl_irq_control_invocation_relation (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) (IRQControl (UCAST(32 \<rightarrow> 10) x21) x' slot')
 2. \<And>x21 x21a x21b x22b rv x x' s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (CSpaceAcc_A.ensure_empty x')
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x21b x22b rv x x' s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (CSpaceAcc_A.ensure_empty x')
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 8. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x21b x22b rv x x'. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (CSpaceAcc_A.ensure_empty x')
 2. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 7. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21a (unat x21b) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x21b x22b rv. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b rv s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21a) (unat x21b) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 6. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv s x. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (IRQControl (UCAST(32 \<rightarrow> 10) x21) x slot')
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x22b rv s x sa. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; sa = s\<rbrakk> \<Longrightarrow> s = sa \<and> True
 2. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 2. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x22b s. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs) s
 2. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x22b cs. \<lbrakk>cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' = GenInvocationLabel IRQIssueIRQHandler; cap = IrqControlCap; args' = x21 # x21a # x21b # x22b; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21a x21b; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal:
No subgoals! proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps'))
 2. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index excaps 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq slot dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index excaps 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq slot dest_slot_cap_ref
odE \<sqinter> throw) (if gen_invocation_type label' = IRQIssueIRQHandler then if 3 \<le> length args' \<and> 1 \<le> length (map fst excaps') then let irq_word = args' ! 0; index = args' ! 1; depth = args' ! 2; cnode = map fst excaps' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) $ throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ));
irq_active <- liftE $ is_irq_active irq;
whenE irq_active $ throwError RevokeFirst;
dest_slot <- lookup_target_slot cnode (data_to_cptr index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ IRQControl irq dest_slot slot'
odE else throwError TruncatedMessage else liftME ArchIRQControl $ if invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler then if 4 \<le> length args' \<and> 1 \<le> length (map fst excaps') then let irq_word = args' ! 0; trigger = args' ! 1; index = args' ! 2; depth = args' ! 3; cnode = map fst excaps' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) $ throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ));
irq_active <- liftE $ is_irq_active irq;
whenE irq_active $ throwError RevokeFirst;
dest_slot <- lookup_target_slot cnode (data_to_cptr index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ ArchIRQControlIssue irq dest_slot slot' (trigger \<noteq> 0)
odE else throwError TruncatedMessage else throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (ArchInvocationLabel ARMIRQIssueIRQHandler) args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (4 \<le> length args' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! 2)) (unat (args' ! 3));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (args' ! Suc 0 \<noteq> 0))
odE))) \<and> (\<not> 4 \<le> length args' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage)))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (4 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! 2)) (unat (args' ! 3));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (args' ! Suc 0 \<noteq> 0))
odE))) \<and> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage))) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> (Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE)) \<and> (\<not> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE)
 2. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> \<not> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> \<not> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; \<not> Suc 0 \<le> length excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; \<not> Suc 0 \<le> length excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (?Q80 x21 x21a x21b x21c x22c) (?Q'80 x21 x21a x21b x21c x22c) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)
 2. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; \<not> Suc 0 \<le> length excaps'; True\<rbrakk> \<Longrightarrow> ?Q80 x21 x21a x21b x21c x22c s
 3. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; \<not> Suc 0 \<le> length excaps'; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> ?Q'80 x21 x21a x21b x21c x22c s
 4. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; \<not> Suc 0 \<le> length excaps'; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; \<not> Suc 0 \<le> length excaps'; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; x22 = x21a # x21b # x21c # x22c; x22a = x21b # x21c # x22c; x22b = x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c\<rbrakk> \<Longrightarrow> Suc 0 \<le> length excaps' \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq = UCAST(32 \<rightarrow> 10) x21 in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue irq dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < x21) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)))
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; UCAST(10 \<rightarrow> 32) maxIRQ < x21; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; UCAST(10 \<rightarrow> 32) maxIRQ < x21; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE irq_active <- liftE (is_irq_active (UCAST(32 \<rightarrow> 10) x21));
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE y <- whenE rv (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError RevokeFirst)
 2. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)
 3. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (?Q104 x21 x21a x21b x21c x22c rv) (?Q'104 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError RevokeFirst)
 2. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; True\<rbrakk> \<Longrightarrow> ?Q104 x21 x21a x21b x21c x22c rv s
 3. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; ?Q'97 x21 x21a x21b x21c x22c rv s\<rbrakk> \<Longrightarrow> ?Q'104 x21 x21a x21b x21c x22c rv s
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)
 5. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; rv; ?Q'97 x21 x21a x21b x21c x22c rv s\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)
 4. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c rv) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv\<rbrakk> \<Longrightarrow> (excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c False) (doE dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)) \<and> (excaps' = [] \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c False) (throw \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False ([] ! 0) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE))
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c False) (doE dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c);
returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) dest_slot slot' (x21a \<noteq> 0))
odE)
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'114 x21 x21a x21b x21c x22c rv) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c False) (CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<sqinter> throw) (CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c))
 2. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; ?r'114 x21 x21a x21b x21c x22c rv x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0))
odE)
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 x21 x21a x21b x21c x22c False\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'114 x21 x21a x21b x21c x22c rv) (\<lambda>_. True) (?Q'97 x21 x21a x21b x21c x22c False) (CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c)) (CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c))
 2. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; ?r'114 x21 x21a x21b x21c x22c rv x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0))
odE)
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'97 x21 x21a x21b x21c x22c False\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>?Q'97 x21 x21a x21b x21c x22c\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> x21b = of_bl (to_bl x21b)
 2. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> length (to_bl x21b) = 32
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) = transform_cap (fst (excaps' ! 0))
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> unat x21c = unat x21c
 5. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0))
odE)
 6. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) = transform_cap (fst (excaps' ! 0))
 2. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> unat x21c = unat x21c
 3. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0))
odE)
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (doE y <- CSpaceAcc_A.ensure_empty x';
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0))
odE)
 2. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<sqinter> throw) (returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0)))
 2. \<And>x21 x21a x21b x21c x22c rv x x' s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (?Q'114 x21 x21a x21b x21c x22c rv x') (CSpaceAcc_A.ensure_empty x')
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. cdl_irq_control_invocation_relation a \<circ> ArchIRQControl)) (?Q114 x21 x21a x21b x21c x22c rv x) (?Q'114 x21 x21a x21b x21c x22c rv x') (returnOk (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x)) (returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0)))
 2. \<And>x21 x21a x21b x21c x22c rv x x' s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (?Q'114 x21 x21a x21b x21c x22c rv x') (CSpaceAcc_A.ensure_empty x')
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>?Q114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>?Q'114 x21 x21a x21b x21c x22c rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'114 x21 x21a x21b x21c x22c rv x s'\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv x x' s s'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True; True\<rbrakk> \<Longrightarrow> (cdl_irq_control_invocation_relation (IssueIrqHandler (UCAST(32 \<rightarrow> 10) x21) (transform_cslot_ptr slot') x) \<circ> ArchIRQControl) (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x' slot' (x21a \<noteq> 0))
 2. \<And>x21 x21a x21b x21c x22c rv x x' s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (CSpaceAcc_A.ensure_empty x')
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 9. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv x x' s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpaceAcc_A.ensure_empty x' \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (CSpaceAcc_A.ensure_empty x')
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 8. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv x x'. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; x = transform_cslot_ptr x'\<rbrakk> \<Longrightarrow> False \<longrightarrow> no_fail (\<lambda>_. True) (CSpaceAcc_A.ensure_empty x')
 2. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 7. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> CSpace_D.lookup_slot_for_cnode_op (fst (case excaps' ! 0 of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot))) x21b (unat x21c) \<lbrace>\<lambda>x _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x21b x21c x22c rv. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>x' _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c rv s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! 0)) (to_bl x21b) (unat x21c) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 6. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv s x. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s\<rbrace> doE y <- CSpaceAcc_A.ensure_empty x;
returnOk (ArchIRQControlIssue (UCAST(32 \<rightarrow> 10) x21) x slot' (x21a \<noteq> 0))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x21b x21c x22c rv s x sa. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; \<not> rv; excaps' \<noteq> []; sa = s\<rbrakk> \<Longrightarrow> s = sa \<and> True
 2. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 3. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x21c x22c. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>a. valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs\<rbrace>
 2. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x21b x21c x22c s. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21; (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) s\<rbrakk> \<Longrightarrow> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps' ! 0)) and valid_global_refs and valid_idle and valid_etcbs) s
 2. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x21b x21c x22c cs. \<lbrakk>cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; args' = x21 # x21a # x21b # x21c # x22c; ui = IrqControlIssueIrqHandlerIntent (UCAST(32 \<rightarrow> 10) x21) x21b x21c; Suc 0 \<le> length excaps'; \<not> UCAST(10 \<rightarrow> 32) maxIRQ < x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> is_irq_active (UCAST(32 \<rightarrow> 10) x21) \<lbrace>\<lambda>r s. transform s = cs\<rbrace> proof (prove)
goal:
No subgoals! proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (Interrupt_D.decode_irq_control_invocation cap slot excaps ui) (Decode_A.decode_irq_control_invocation label' args' slot' (map fst excaps')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = transform_cap cap'; cap' = IRQControlCap; slot = transform_cslot_ptr slot'; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index excaps 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq slot dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index excaps 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq slot dest_slot_cap_ref
odE \<sqinter> throw) (if gen_invocation_type label' = IRQIssueIRQHandler then if 3 \<le> length args' \<and> 1 \<le> length (map fst excaps') then let irq_word = args' ! 0; index = args' ! 1; depth = args' ! 2; cnode = map fst excaps' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) $ throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ));
irq_active <- liftE $ is_irq_active irq;
whenE irq_active $ throwError RevokeFirst;
dest_slot <- lookup_target_slot cnode (data_to_cptr index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ IRQControl irq dest_slot slot'
odE else throwError TruncatedMessage else liftME ArchIRQControl $ if invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler then if 4 \<le> length args' \<and> 1 \<le> length (map fst excaps') then let irq_word = args' ! 0; trigger = args' ! 1; index = args' ! 2; depth = args' ! 3; cnode = map fst excaps' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) $ throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ));
irq_active <- liftE $ is_irq_active irq;
whenE irq_active $ throwError RevokeFirst;
dest_slot <- lookup_target_slot cnode (data_to_cptr index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ ArchIRQControlIssue irq dest_slot slot' (trigger \<noteq> 0)
odE else throwError TruncatedMessage else throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (IrqControlIntent ui) = transform_intent (invocation_type label') args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ui of IrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw | ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent irq index depth) \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) proof (prove)
goal (2 subgoals):
 1. \<And>x11 x12 x13. \<lbrakk>Some (IrqControlIntent (IrqControlIssueIrqHandlerIntent x11 x12 x13)) = transform_intent (invocation_type label') args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; ui = IrqControlIssueIrqHandlerIntent x11 x12 x13\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x12 (unat x13);
returnOk (IssueIrqHandler x11 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x12 (unat x13);
returnOk (IssueIrqHandler x11 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError IllegalOperation))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x12 (unat x13);
returnOk (IssueIrqHandler x11 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x12 (unat x13);
returnOk (IssueIrqHandler x11 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError IllegalOperation)))
 2. \<And>x2. \<lbrakk>Some (IrqControlIntent (ArchIrqControlIssueIrqHandlerIntent x2)) = transform_intent (invocation_type label') args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; ui = ArchIrqControlIssueIrqHandlerIntent x2\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>Some (IrqControlIntent (ArchIrqControlIssueIrqHandlerIntent x2)) = transform_intent (invocation_type label') args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; ui = ArchIrqControlIssueIrqHandlerIntent x2\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case x2 of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) proof (prove)
goal (1 subgoal):
 1. \<And>ARMIRQControlIntent. \<lbrakk>Some (IrqControlIntent (ArchIrqControlIssueIrqHandlerIntent ARMIRQControlIntent)) = transform_intent (invocation_type label') args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; ui = ArchIrqControlIssueIrqHandlerIntent ARMIRQControlIntent\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ARMIRQControlIntent of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ARMIRQControlIntent of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ARMIRQControlIntent of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (case ARMIRQControlIntent of ARMIrqControlIssueIrqHandlerIntent irq index depth \<Rightarrow> doE root <- throw_on_none $ get_index (transform_cap_list excaps') 0;
cnode_cap <- returnOk $ fst root;
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op cnode_cap index (unat depth);
returnOk $ IssueIrqHandler irq (transform_cslot_ptr slot') dest_slot_cap_ref
odE \<sqinter> throw) (throwError IllegalOperation))) proof (prove)
goal (1 subgoal):
 1. \<And>ARMIRQControlIntent x1 x2 x3. \<lbrakk>Some (IrqControlIntent (ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent x1 x2 x3))) = transform_intent (invocation_type label') args'; cap = IrqControlCap; cap' = IRQControlCap; excaps = transform_cap_list excaps'; invocation_type label' \<noteq> GenInvocationLabel IRQIssueIRQHandler; invocation_type label' \<noteq> ArchInvocationLabel ARMIRQIssueIRQHandler; slot = transform_cslot_ptr slot'; ui = ArchIrqControlIssueIrqHandlerIntent (ARMIrqControlIssueIrqHandlerIntent x1 x2 x3); ARMIRQControlIntent = ARMIrqControlIssueIrqHandlerIntent x1 x2 x3\<rbrakk> \<Longrightarrow> (3 \<le> length args' \<and> Suc 0 \<le> length excaps' \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x2 (unat x3);
returnOk (IssueIrqHandler x1 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (let irq_word = args' ! 0; irq = UCAST(32 \<rightarrow> 10) irq_word in doE y <- whenE (UCAST(10 \<rightarrow> 32) maxIRQ < irq_word) (throwError (RangeError 0 (UCAST(10 \<rightarrow> 32) maxIRQ)));
irq_active <- liftE (is_irq_active irq);
y <- whenE irq_active (throwError RevokeFirst);
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (map fst excaps' ! 0) (to_bl (args' ! Suc 0)) (unat (args' ! 2));
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (IRQControl irq dest_slot slot')
odE)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x2 (unat x3);
returnOk (IssueIrqHandler x1 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError IllegalOperation))) \<and> ((3 \<le> length args' \<longrightarrow> \<not> Suc 0 \<le> length excaps') \<longrightarrow> (gen_invocation_type label' = IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> cdl_irq_control_invocation_relation) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x2 (unat x3);
returnOk (IssueIrqHandler x1 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError TruncatedMessage)) \<and> (gen_invocation_type label' \<noteq> IRQIssueIRQHandler \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. cdl_irq_control_invocation_relation x \<circ> ArchIRQControl)) (\<lambda>_. True) (valid_objs and (\<lambda>s. \<forall>e\<in>set excaps'. s \<turnstile> fst e) and valid_global_refs and valid_idle and valid_etcbs) (doE root <- throw_on_none (get_index (transform_cap_list excaps') 0);
dest_slot_cap_ref <- CSpace_D.lookup_slot_for_cnode_op (fst root) x2 (unat x3);
returnOk (IssueIrqHandler x1 (transform_cslot_ptr slot') dest_slot_cap_ref)
odE \<sqinter> throw) (throwError IllegalOperation))) proof (prove)
goal:
No subgoals! proof (prove)
goal:
No subgoals!