theory IpcCancel_R

lemma cancelSignal_invs':
  "\<lbrace>invs' and st_tcb_at' (\<lambda>st. st = BlockedOnNotification ntfn) t and sch_act_not t\<rbrace>
    cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace>" proof - have NIQ: "\<And>s. \<lbrakk> Invariants_H.valid_queues s; st_tcb_at' (Not \<circ> runnable') t s \<rbrakk>
                                         \<Longrightarrow> \<forall>x. t \<notin> set (ksReadyQueues s x)" apply (clarsimp simp add: pred_tcb_at'_def Invariants_H.valid_queues_def
                                valid_queues_no_bitmap_def) apply (drule spec | drule(1) bspec | clarsimp simp: obj_at'_def inQ_def)+ done have NTFNSN: "\<And>ntfn ntfn'.
                    \<lbrace>\<lambda>s. sch_act_not (ksCurThread s) s \<rbrace> setNotification ntfn ntfn'
                    \<lbrace>\<lambda>_ s. sch_act_not (ksCurThread s) s\<rbrace>" apply (rule hoare_weaken_pre) apply (wps setNotification_ksCurThread) apply (wp, simp) done show ?thesis apply (simp add: cancelSignal_def invs'_def valid_state'_def Let_def) apply (wp valid_irq_node_lift sts_sch_act' irqs_masked_lift
                hoare_vcg_all_lift [OF setNotification_ksQ] sts_valid_queues
                setThreadState_ct_not_inQ NTFNSN
                hoare_vcg_all_lift setNotification_ksQ
              | simp add: valid_tcb_state'_def list_case_If split del: if_split)+ prefer 2 apply assumption apply (rule hoare_strengthen_post) apply (rule get_ntfn_sp') apply (rename_tac rv s) apply (clarsimp simp: pred_tcb_at') apply (frule NIQ) apply (clarsimp simp: pred_tcb_at'_def obj_at'_def) apply (rule conjI) apply (clarsimp simp: valid_ntfn'_def) apply (case_tac "ntfnObj rv", simp_all add: isWaitingNtfn_def) apply (frule ko_at_valid_objs') apply (simp add: valid_pspace_valid_objs') apply (clarsimp simp: projectKO_opt_ntfn split: kernel_object.splits) apply (simp add: valid_obj'_def valid_ntfn'_def) apply (frule st_tcb_at_state_refs_ofD') apply (frule ko_at_state_refs_ofD') apply (rule conjI, erule delta_sym_refs) apply (clarsimp simp: ntfn_bound_refs'_def split: if_split_asm) apply (clarsimp split: if_split_asm) subgoal by (fastforce simp: symreftype_inverse' ntfn_bound_refs'_def
                               tcb_bound_refs'_def ntfn_q_refs_of'_def obj_at'_def projectKOs
                        split: ntfn.splits option.splits) subgoal by (fastforce simp: symreftype_inverse' ntfn_bound_refs'_def
                                tcb_bound_refs'_def) subgoal by (fastforce simp: symreftype_inverse' ntfn_bound_refs'_def
                               tcb_bound_refs'_def ntfn_q_refs_of'_def remove1_empty
                        split: ntfn.splits) apply (rule conjI, clarsimp elim!: if_live_state_refsE) apply (fastforce simp: sym_refs_def dest!: idle'_no_refs) apply (case_tac "ntfnObj rv", simp_all) apply (frule obj_at_valid_objs', clarsimp) apply (clarsimp simp: projectKOs valid_obj'_def valid_ntfn'_def) apply (rule conjI, clarsimp split: option.splits) apply (frule st_tcb_at_state_refs_ofD') apply (frule ko_at_state_refs_ofD') apply (rule conjI) apply (erule delta_sym_refs) apply (fastforce simp: ntfn_bound_refs'_def split: if_split_asm) apply (clarsimp split: if_split_asm) apply (fastforce simp: symreftype_inverse' ntfn_bound_refs'_def tcb_bound_refs'_def
                               set_eq_subset) apply (fastforce simp: symreftype_inverse' ntfn_bound_refs'_def tcb_bound_refs'_def
                              set_eq_subset) apply (rule conjI, clarsimp elim!: if_live_state_refsE) apply (rule conjI) apply (case_tac "ntfnBoundTCB r") apply (clarsimp elim!: if_live_state_refsE)+ apply (rule conjI, clarsimp split: option.splits) apply (clarsimp dest!: idle'_no_refs) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace> proof (state)
goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>Invariants_H.valid_queues s; st_tcb_at' (Not \<circ> runnable') t s\<rbrakk> \<Longrightarrow> \<forall>x. t \<notin> set (ksReadyQueues s x) proof (prove)
goal (1 subgoal):
 1. \<And>s a b. \<lbrakk>obj_at' (\<lambda>ko. \<not> runnable' (tcbState ko)) t s; \<forall>d p. (\<forall>t\<in>set (ksReadyQueues s (d, p)). obj_at' (inQ d p and runnable' \<circ> tcbState) t s) \<and> distinct (ksReadyQueues s (d, p)) \<and> (maxDomain < d \<longrightarrow> ksReadyQueues s (d, p) = []) \<and> (maxPriority < p \<longrightarrow> ksReadyQueues s (d, p) = []); valid_bitmapQ s; bitmapQ_no_L2_orphans s; bitmapQ_no_L1_orphans s; t \<in> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>Invariants_H.valid_queues ?s; st_tcb_at' (Not \<circ> runnable') t ?s\<rbrakk> \<Longrightarrow> \<forall>x. t \<notin> set (ksReadyQueues ?s x)

goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>ntfn ntfn'. \<lbrace>\<lambda>s. sch_act_not (ksCurThread s) s\<rbrace> setNotification ntfn ntfn' \<lbrace>\<lambda>_ s. sch_act_not (ksCurThread s) s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>ntfn ntfn'. \<lbrace>?Q ntfn ntfn'\<rbrace> setNotification ntfn ntfn' \<lbrace>\<lambda>_ s. sch_act_not (ksCurThread s) s\<rbrace>
 2. \<And>ntfn ntfn' s. sch_act_not (ksCurThread s) s \<Longrightarrow> ?Q ntfn ntfn' s proof (prove)
goal (2 subgoals):
 1. \<And>ntfn ntfn' prev_s. \<lbrace>?P3 ntfn ntfn' prev_s\<rbrace> setNotification ntfn ntfn' \<lbrace>\<lambda>rv s'. sch_act_not (ksCurThread prev_s) prev_s\<rbrace>
 2. \<And>ntfn ntfn' s. sch_act_not (ksCurThread s) s \<Longrightarrow> ?P3 ntfn ntfn' s s proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>\<lambda>s. sch_act_not (ksCurThread s) s\<rbrace> setNotification ?ntfn ?ntfn' \<lbrace>\<lambda>_ s. sch_act_not (ksCurThread s) s\<rbrace>

goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> do ntfna <- getNotification ntfn;
y <- assert (case ntfnObj ntfna of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False);
ntfn' <- case remove1 t (ntfnQueue (ntfnObj ntfna)) of [] \<Rightarrow> return $ Structures_H.ntfn.IdleNtfn | a # list \<Rightarrow> return $ ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna);
y <- setNotification ntfn (ntfnObj_update (\<lambda>_. ntfn') ntfna);
setThreadState Structures_H.thread_state.Inactive t
od \<lbrace>\<lambda>rv. (\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> getNotification ntfn \<lbrace>\<lambda>ntfna s. (case ntfnObj ntfna of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False) \<longrightarrow> (remove1 t (ntfnQueue (ntfnObj ntfna)) = [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB ntfna = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) \<and> (remove1 t (ntfnQueue (ntfnObj ntfna)) \<noteq> [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB ntfna = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s)\<rbrace>
 2. \<And>s. ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t) s \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. \<And>s. ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t) s \<Longrightarrow> ?Q s
 2. \<lbrace>?Q\<rbrace> getNotification ntfn \<lbrace>\<lambda>ntfna s. (case ntfnObj ntfna of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False) \<longrightarrow> (remove1 t (ntfnQueue (ntfnObj ntfna)) = [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB ntfna = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) \<and> (remove1 t (ntfnQueue (ntfnObj ntfna)) \<noteq> [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB ntfna = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> getNotification ntfn \<lbrace>\<lambda>ntfna s. (case ntfnObj ntfna of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False) \<longrightarrow> (remove1 t (ntfnQueue (ntfnObj ntfna)) = [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB ntfna = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfna) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) \<and> (remove1 t (ntfnQueue (ntfnObj ntfna)) \<noteq> [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB ntfna = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj ntfna))) (ntfnObj ntfna)) ntfna) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>(\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> getNotification ntfn \<lbrace>?Q253\<rbrace>
 2. \<And>rv s. ?Q253 rv s \<Longrightarrow> (case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False) \<longrightarrow> (remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) \<and> (remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) proof (prove)
goal (1 subgoal):
 1. \<And>rv s. ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t and ko_at' rv ntfn) s \<Longrightarrow> (case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False) \<longrightarrow> (remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) \<and> (remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) proof (prove)
goal (1 subgoal):
 1. \<And>rv s. ((\<lambda>s. valid_pspace' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t and ko_at' rv ntfn) s \<Longrightarrow> (case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False) \<longrightarrow> (remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) \<and> (remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> tcb_at' t s \<and> sch_act_not t s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> if_live_then_nonz_cap' s \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_pspace' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> valid_irq_handlers' s \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s) proof (prove)
goal (1 subgoal):
 1. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> (remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s) \<and> (remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s) proof (prove)
goal (2 subgoals):
 1. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> st_tcb_at' (Not \<circ> runnable') t s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>x. t \<notin> set (ksReadyQueues s x)\<rbrakk> \<Longrightarrow> (remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s) \<and> (remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s) proof (prove)
goal (1 subgoal):
 1. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>x. t \<notin> set (ksReadyQueues s x)\<rbrakk> \<Longrightarrow> (remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s) \<and> (remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s) proof (prove)
goal (2 subgoals):
 1. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>x. t \<notin> set (ksReadyQueues s x)\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) = [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv) s \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>x. t \<notin> set (ksReadyQueues s x)\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t (ntfnQueue (ntfnObj rv)) = []\<rbrakk> \<Longrightarrow> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>x. t \<notin> set (ksReadyQueues s x)\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> (\<forall>x xa. t \<notin> set (ksReadyQueues s (x, xa))) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (4 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>rv s x3 ko. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; projectKO_opt ko = Some rv\<rbrakk> \<Longrightarrow> injectKO rv = ko
 3. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; valid_obj' (injectKO rv) s\<rbrakk> \<Longrightarrow> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> t \<noteq> ksIdleThread s
 4. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (3 subgoals):
 1. \<And>rv s x3 ko. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; projectKO_opt ko = Some rv\<rbrakk> \<Longrightarrow> injectKO rv = ko
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; valid_obj' (injectKO rv) s\<rbrakk> \<Longrightarrow> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> t \<noteq> ksIdleThread s
 3. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; valid_obj' (injectKO rv) s\<rbrakk> \<Longrightarrow> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (4 subgoals):
 1. \<And>rv s x3 x y tp. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); (y, tp) \<in> (if x = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) y)
 2. \<And>rv s x3 x y tp. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) y)
 3. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 4. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (3 subgoals):
 1. \<And>rv s x3 x y tp. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) rv)))) y)
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 3. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (5 subgoals):
 1. \<And>rv s x3 y tp ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) ntfn s; sch_act_not ntfn s; ko_at' rv ntfn s; \<forall>a b. ntfn \<notin> set (ksReadyQueues s (a, b)); remove1 ntfn x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; state_refs_of' s ntfn = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); y = ntfn \<and> tp = TCBSignal \<or> (y, tp) \<in> tcb_bound_refs' ntfnptr; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; obj_at' (tcb_ntfn_is_bound' ntfnptr) ntfn s; set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv) = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); t = ntfn; (y, tp) \<in> ntfn_bound_refs' (ntfnBoundTCB rv) \<longrightarrow> tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (ntfn, symreftype tp) \<in> ntfn_bound_refs' (ntfnBoundTCB rv) \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> ntfn \<longrightarrow> (ntfn, symreftype tp) \<notin> state_refs_of' s y)
 2. \<And>rv s x3 y tp ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y = ntfn \<and> tp = TCBSignal \<or> (y, tp) \<in> tcb_bound_refs' ntfnptr; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); t \<noteq> ntfn; tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (t, symreftype tp) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> (y = t \<longrightarrow> (t, symreftype tp) \<in> tcb_bound_refs' ntfnptr \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> t \<longrightarrow> (t, symreftype tp) \<notin> state_refs_of' s y))
 3. \<And>rv s x3 y ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y \<in> set x3; ntfn \<noteq> t; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); (y, NTFNSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (ntfn, TCBSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> y \<noteq> t \<longrightarrow> (ntfn, TCBSignal) \<notin> state_refs_of' s y)
 4. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 5. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_pspace' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; valid_irq_handlers' s_; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) ntfn s_; sch_act_not ntfn s_; ko_at' rv_ ntfn s_; \<forall>a b. ntfn \<notin> set (ksReadyQueues s_ (a, b)); remove1 ntfn x3_ = []; ntfnObj rv_ = Structures_H.ntfn.WaitingNtfn x3_; state_refs_of' s_ ntfn = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr_); y_ = ntfn \<and> tp_ = TCBSignal \<or> (y_, tp_) \<in> tcb_bound_refs' ntfnptr_; x3_ \<noteq> []; \<forall>t\<in>set x3_. tcb_at' t s_; distinct x3_; case ntfnBoundTCB rv_ of None \<Rightarrow> True | Some tcb \<Rightarrow> x3_ = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv_) s_; obj_at' (tcb_ntfn_is_bound' ntfnptr_) ntfn s_; set x3_ \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv_) = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr_); t = ntfn; (y_, tp_) \<in> ntfn_bound_refs' (ntfnBoundTCB rv_) \<longrightarrow> tp_ \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y_ = ntfn \<longrightarrow> (ntfn, symreftype tp_) \<in> ntfn_bound_refs' (ntfnBoundTCB rv_) \<longrightarrow> symreftype tp_ \<noteq> TCBBound) \<and> (y_ \<noteq> ntfn \<longrightarrow> (ntfn, symreftype tp_) \<notin> state_refs_of' s_ y_) proof (prove)
goal (4 subgoals):
 1. \<And>rv s x3 y tp ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y = ntfn \<and> tp = TCBSignal \<or> (y, tp) \<in> tcb_bound_refs' ntfnptr; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); t \<noteq> ntfn; tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (t, symreftype tp) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> (y = t \<longrightarrow> (t, symreftype tp) \<in> tcb_bound_refs' ntfnptr \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> t \<longrightarrow> (t, symreftype tp) \<notin> state_refs_of' s y))
 2. \<And>rv s x3 y ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y \<in> set x3; ntfn \<noteq> t; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); (y, NTFNSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (ntfn, TCBSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> y \<noteq> t \<longrightarrow> (ntfn, TCBSignal) \<notin> state_refs_of' s y)
 3. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 4. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_pspace' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; valid_irq_handlers' s_; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s_; sch_act_not t s_; ko_at' rv_ ntfn s_; \<forall>a b. t \<notin> set (ksReadyQueues s_ (a, b)); remove1 t x3_ = []; ntfnObj rv_ = Structures_H.ntfn.WaitingNtfn x3_; state_refs_of' s_ ntfn = set x3_ \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv_); y_ = ntfn \<and> tp_ = TCBSignal \<or> (y_, tp_) \<in> tcb_bound_refs' ntfnptr_; x3_ \<noteq> []; \<forall>t\<in>set x3_. tcb_at' t s_; distinct x3_; case ntfnBoundTCB rv_ of None \<Rightarrow> True | Some tcb \<Rightarrow> x3_ = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv_) s_; obj_at' (tcb_ntfn_is_bound' ntfnptr_) t s_; state_refs_of' s_ t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr_); t \<noteq> ntfn; tp_ \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y_ = ntfn \<longrightarrow> (t, symreftype tp_) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv_)) \<and> (y_ \<noteq> ntfn \<longrightarrow> (y_ = t \<longrightarrow> (t, symreftype tp_) \<in> tcb_bound_refs' ntfnptr_ \<longrightarrow> symreftype tp_ \<noteq> TCBBound) \<and> (y_ \<noteq> t \<longrightarrow> (t, symreftype tp_) \<notin> state_refs_of' s_ y_)) proof (prove)
goal (3 subgoals):
 1. \<And>rv s x3 y ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y \<in> set x3; ntfn \<noteq> t; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); (y, NTFNSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (ntfn, TCBSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> y \<noteq> t \<longrightarrow> (ntfn, TCBSignal) \<notin> state_refs_of' s y)
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 3. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_pspace' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; valid_irq_handlers' s_; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s_; sch_act_not t s_; ko_at' rv_ ntfn s_; \<forall>a b. t \<notin> set (ksReadyQueues s_ (a, b)); remove1 t x3_ = []; ntfnObj rv_ = Structures_H.ntfn.WaitingNtfn x3_; state_refs_of' s_ ntfn = set x3_ \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv_); y_ \<in> set x3_; ntfn \<noteq> t; x3_ \<noteq> []; \<forall>t\<in>set x3_. tcb_at' t s_; distinct x3_; case ntfnBoundTCB rv_ of None \<Rightarrow> True | Some tcb \<Rightarrow> x3_ = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv_) s_; obj_at' (tcb_ntfn_is_bound' ntfnptr_) t s_; state_refs_of' s_ t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr_); (y_, NTFNSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv_)\<rbrakk> \<Longrightarrow> (y_ = ntfn \<longrightarrow> (ntfn, TCBSignal) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv_)) \<and> (y_ \<noteq> ntfn \<longrightarrow> y_ \<noteq> t \<longrightarrow> (ntfn, TCBSignal) \<notin> state_refs_of' s_ y_) proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); remove1 t x3 = []; ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]) \<and> valid_bound_tcb' (ntfnBoundTCB rv) s; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s
 2. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; case ntfnObj rv of Structures_H.ntfn.WaitingNtfn x \<Rightarrow> True | _ \<Rightarrow> False; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b))\<rbrakk> \<Longrightarrow> remove1 t (ntfnQueue (ntfnObj rv)) \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ((\<exists>ts. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv) = Structures_H.ntfn.WaitingNtfn ts) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> remove1 t x3 \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (remove1 t x3)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (remove1 t x3)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; \<exists>k. k = rv \<and> ((\<forall>ko. projectKO_opt ko = Some k \<longrightarrow> injectKO k = ko) \<longrightarrow> valid_obj' (injectKO k) s)\<rbrakk> \<Longrightarrow> remove1 t x3 \<noteq> [] \<longrightarrow> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (remove1 t x3)) rv) s \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (remove1 t x3)) rv) s \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []\<rbrakk> \<Longrightarrow> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a) \<and> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) a)
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (3 subgoals):
 1. \<And>rv s x3 x y tp. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); (y, tp) \<in> (if x = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) y)
 2. \<And>rv s x3 x y tp. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) y)
 3. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3 x y tp. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = t then {r \<in> ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) t. snd r = TCBBound} else ((state_refs_of' s)(ntfn := ntfn_q_refs_of' (ntfnObj (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)) \<union> ntfn_bound_refs' (ntfnBoundTCB (ntfnObj_update (\<lambda>_. ntfnQueue_update (\<lambda>_. remove1 t (ntfnQueue (ntfnObj rv))) (ntfnObj rv)) rv)))) y)
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (3 subgoals):
 1. \<And>rv s x3 y tp ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) ntfn s; sch_act_not ntfn s; ko_at' rv ntfn s; \<forall>a b. ntfn \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 ntfn x3 \<noteq> []; state_refs_of' s ntfn = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); y = ntfn \<and> tp = TCBSignal \<or> (y, tp) \<in> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) ntfn s; set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv) = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); t = ntfn; (y, tp) \<in> ntfn_bound_refs' (ntfnBoundTCB rv) \<longrightarrow> tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (ntfn, symreftype tp) \<in> ntfn_bound_refs' (ntfnBoundTCB rv) \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> ntfn \<longrightarrow> (ntfn, symreftype tp) \<notin> state_refs_of' s y)
 2. \<And>rv s x3 y tp ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y = ntfn \<and> tp = TCBSignal \<or> (y, tp) \<in> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); t \<noteq> ntfn; tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (t, symreftype tp) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> (y = t \<longrightarrow> (t, symreftype tp) \<in> tcb_bound_refs' ntfnptr \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> t \<longrightarrow> (t, symreftype tp) \<notin> state_refs_of' s y))
 3. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3 y tp ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); y = ntfn \<and> tp = TCBSignal \<or> (y, tp) \<in> tcb_bound_refs' ntfnptr; obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr); t \<noteq> ntfn; tp \<noteq> TCBBound\<rbrakk> \<Longrightarrow> (y = ntfn \<longrightarrow> (t, symreftype tp) \<notin> ntfn_bound_refs' (ntfnBoundTCB rv)) \<and> (y \<noteq> ntfn \<longrightarrow> (y = t \<longrightarrow> (t, symreftype tp) \<in> tcb_bound_refs' ntfnptr \<longrightarrow> symreftype tp \<noteq> TCBBound) \<and> (y \<noteq> t \<longrightarrow> (t, symreftype tp) \<notin> state_refs_of' s y))
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ((\<exists>y. ntfnBoundTCB rv = Some y) \<longrightarrow> ex_nonz_cap_to' ntfn s) \<and> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn s \<and> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn s
 2. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (3 subgoals):
 1. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); ntfnBoundTCB r = None\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn s
 2. \<And>rv s x3 a. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv); ntfnBoundTCB r = Some a\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn s
 3. \<And>rv s x3. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; \<exists>ts ntfnptr. ts = Structures_H.thread_state.BlockedOnNotification ntfn \<and> obj_at' (tcb_ntfn_is_bound' ntfnptr) t s \<and> state_refs_of' s t = tcb_st_refs_of' ts \<union> tcb_bound_refs' ntfnptr; state_refs_of' s ntfn = refs_of' (injectKO rv)\<rbrakk> \<Longrightarrow> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3 ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> (case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> remove1 t x3 = [tcb]) \<and> t \<noteq> ksIdleThread s proof (prove)
goal (1 subgoal):
 1. \<And>rv s x3 ntfnptr. \<lbrakk>valid_pspace' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t s; sch_act_not t s; ko_at' rv ntfn s; \<forall>a b. t \<notin> set (ksReadyQueues s (a, b)); ntfnObj rv = Structures_H.ntfn.WaitingNtfn x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; case ntfnBoundTCB rv of None \<Rightarrow> True | Some tcb \<Rightarrow> x3 = [tcb]; valid_bound_tcb' (ntfnBoundTCB rv) s; remove1 t x3 \<noteq> []; state_refs_of' s ntfn = set x3 \<times> {NTFNSignal} \<union> ntfn_bound_refs' (ntfnBoundTCB rv); obj_at' (tcb_ntfn_is_bound' ntfnptr) t s; state_refs_of' s t = insert (ntfn, TCBSignal) (tcb_bound_refs' ntfnptr)\<rbrakk> \<Longrightarrow> t \<noteq> ksIdleThread s proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>invs' and st_tcb_at' (\<lambda>st. st = Structures_H.thread_state.BlockedOnNotification ntfn) t and sch_act_not t\<rbrace> cancelSignal t ntfn \<lbrace>\<lambda>rv. invs'\<rbrace>

goal:
No subgoals!