Appendices with PVS source code and proofs for the document

Nova Micro-Hypervisor Verification B PVS Theory Sources

Contents for Appendix B

B.1 abstract_data.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
B.2 allocators.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
B.3 bits.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
B.4 challenge-linear.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
B.5 challenge-phymem.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
B.6 challenge-ptab-sync-master.pvs . . . . . . . . . . . . . . . . . . . . . . . 119
B.7 constants.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
B.8 conversions.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.9 cpp-examples.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
B.10 cpp-verification.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
B.11 datatype_model.pvs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
B.12 device_memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
B.13 everything.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
B.14 expressions.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
B.15 graph.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
B.16 hoare.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
B.17 linear_memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
B.18 memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
B.19 paging-data-models.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
B.20 paging-data.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
B.21 physical_memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
B.22 plain_memory.pvs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
B.23 plain_memory_rewrites.pvs. . . . . . . . . . . . . . . . . . . . . . . . . . 272
B.24 ptab-sync-master-defs.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . 288
B.25 ptab-sync-master.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
B.26 random_device.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
B.27 result.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
B.28 search-example.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
B.29 statement-rewrites.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
B.30 statements.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
B.31 state-transformer.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
B.32 types.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
B.33 vfiasco-prelude.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434

63 B PVS Theory Sources

B.1 abstract_data.pvs

Uninterpreted_Data: Theory

Begin

Importing IA32
Uninterpreted_data_type: Type =

[#

size : nat,
valid? : [list[Byte], Address −> bool]

#]

uninterpreted_data_type ? : PRED[Uninterpreted_data_type ] =
Lambda(uidt : Uninterpreted_data_type ) :
(Forall(l : list[Byte], a : Address) :
not length(l) = size(uidt) Implies
valid?(uidt)(l,a) = False)
% proof status:−)
u_data_type_length : Lemma
Forall(uidt : (uninterpreted_data_type ?), l : list[Byte], a : Address) :
valid?(uidt)(l,a) Implies length(l) = size(uidt)
End Uninterpreted_Data

Interpreted_Data[Data : Type] : Theory

Begin

IMPORTING Uninterpreted_Data, Address_Util, Bitlist_ops
Interpreted_data_type: Type =

[#

uidt : Uninterpreted_data_type , % Assumptions:
to_byte: [Data, Address −> list[Byte]], % to_byteis zero at unmodifiedbits
to_mask: [Data, Address −> list[Byte]], % to_maskis one at unmodifiedbits
from_byte: [list[Byte], Address −> lift[Data]]

#]

% Thus, new_value= (read & ~to_mask) | to_byte
% and from_bytemust be reasonableon &= to_maskvalues
% proof status:−)
% interpreted_data_type ?_TCC1: TCCObligation
interpreted_data_type ? : PRED[Interpreted_data_type ] =
Lambda(idt : Interpreted_data_type ) :
uninterpreted_data_type ?(idt‘uidt) AND
% resultof to_byteis valid(and has lengthsize)
(Forall(d : Data, a : Address) :
valid?(uidt(idt))(to_byte(idt)(d,a), a)) And

64

B.1 abstract_data.pvs

% from_bytefails on invalidstuff
(Forall(l : list[Byte], a : Address) :
valid?(uidt(idt))(l, a) IFF
up?(from_byte(idt)(l, a))) And
% from_byteis the left inverseof to_byte
% 1. from_bytedoes not fail on to_byteresults
% this follows from the previoustwo

%

% (Forall(d : Data, a : Address) :
% up?(from_byte(idt)(to_byte(idt)(d,a), a))) AND
% 2. the resultis the same
(Forall(d : Data, a : Address) :
down(from_byte(idt)(to_byte(idt)(d,a), a)) = d)
pod_data_type ? : PRED[Interpreted_data_type ] =
Lambda(idt : Interpreted_data_type ) :
interpreted_data_type ?(idt) AND
(Forall(l : list[Byte], a1, a2 : Address) :
valid?(uidt(idt))(l, a1) IFF valid?(uidt(idt))(l, a2)) And
size(uidt(idt)) > 0
% subtypejudgements
% the firsttwo are intuetivelyright, but are not accepted because
% of the subrecordstructure
% interpreted_data_is_uninterpreted_data : Judgement
% (interpreted_data_type ?) SUBTYPE_OF(uninterpreted_data_type ?)
% pod_id_uninterpreted_data : Judgement
% (pod_data_type ?) SUBTYPE_OF(uninterpreted_data_type ?)
% proof status:−)
pod_is_interpreted_data : Judgement
(pod_data_type ?) SUBTYPE_OF(interpreted_data_type ?)
% proof status:−)
pod_size: Lemma
Forall (dt : (pod_data_type ?)) : size(uidt(dt)) > 0
% Utilitypredicates
idt : Var (interpreted_data_type ?)
addr : Var Address
min : Var Memory_Address
max : Var Memory_Address
in_memory?(idt, addr, min, max) : bool =
in_memory(min, max)(addr) And in_memory(min, max)(addr + size(uidt(idt)))

65 B PVS Theory Sources

in_blessed_memory ?(idt, addr, (address_range: PRED[Address])) : bool =
subset?(address_block(addr, size(uidt(idt))), address_range)
% proof status:−)
data_type_length: Lemma Forall(l : list[Byte]) :
valid?(uidt(idt))(l,addr) Implies length(l) = size(uidt(idt))
% proof status:−)
length_to_byte: Lemma Forall(data : Data) :
length(to_byte(idt)(data, addr)) = size(uidt(idt))
% proof status:−)
valid_from_byte: Lemma Forall(l : list[Byte]) :
idt‘uidt‘valid?(l, addr) Implies up?(from_byte(idt)(l, addr))
% proof status:−)
valid_iff_from_byte : Lemma Forall(l : list[Byte]) :
idt‘uidt‘valid?(l, addr) <=> up?(from_byte(idt)(l, addr))
% proof status:−)
valid_to_byte: Lemma Forall(data : Data) :
idt‘uidt‘valid?(to_byte(idt)(data, addr), addr)
% proof status:−)
up_from_byte_to_byte : Lemma Forall(data : Data) :
up?(from_byte(idt)(to_byte(idt)(data, addr), addr))
% proof status:−)
from_byte_to_byte : Lemma Forall(data : Data) :
from_byte(idt)(to_byte(idt)(data, addr), addr) = up(data)
% proof status:−)
in_blessed_memory_subset : Lemma
Forall (address_range: PRED[Address]) :
in_blessed_memory ?(idt, addr, address_range) Implies
subset?(address_block(addr, size(uidt(idt))), address_range)
End Interpreted_Data

Interpreted_Data_Lift [Data1, Data2 : Type] : Theory

Begin

Importing Interpreted_Data
dt_lift(dt : Interpreted_data_type [Data1],
ext : [Data2 −> Data1],
inj : [Data1 −> Data2]) : Interpreted_data_type [Data2] =
(# uidt := uidt(dt),
to_byte:= Lambda (d2 : Data2, a : Address) : to_byte(dt)(ext(d2), a),
to_mask:= Lambda (d2 : Data2, a : Address) : to_mask(dt)(ext(d2), a),

66

B.2 allocators.pvs

from_byte:= Lambda (l : list[Byte], a : Address) :
Cases from_byte(dt)(l, a) Of
up(d1) : up(inj(d1)),
bottom : bottom

EndCases

#)

End Interpreted_Data_Lift

Abstract_Read_Write [State, Data : Type] : Theory

Begin

IMPORTING Memory_Change[State]
IMPORTING State_Transformer_Lift , Interpreted_Data
dt : Var (interpreted_data_type ?[Data]) % dt aka Data_type
addr : Var Address
s : Var State % s aka state
data : Var Data
pm : Var Memory_struct[State]
valid_in_mem (pm,dt)(addr)(s) : bool =
Cases memory_read_list (pm)(addr, size(uidt(dt)))(s) OF
OK(sn, bl) : dt‘uidt‘valid?(bl, addr)
Else true

EndCases

read_data(pm,dt)(addr) : [State −> ExprResult[State, Data]] =
(memory_read_list (pm)(addr, size(uidt(dt))) ##
Lambda(bl : list[Byte]) : ok_lift(from_byte(dt)(bl, addr)))
write_data(pm,dt)(addr, data) : [State −> ExprResult[State, Unit]] =
memory_write_list (pm)(addr, to_byte(dt)(data, addr))
% proof status:−)
read_data_valid_in_mem : Lemma
OK?(read_data(pm, dt)(addr)(s)) Implies valid_in_mem (pm, dt)(addr)(s)
End Abstract_Read_Write

B.2 allocators.pvs

Allocator[State : Type] : Theory
% Specificationof memoryallocatorsworkingon plainmemory,
% such as the stack allocatorand the one for globalvariables.

Begin

Importing Plain_Memory[State]
% The allocatorinterfaceconsistsof two real methodsand four
% logicalones.
% alloc allocatesmemory

67 B PVS Theory Sources

% free frees memory

%

% memory_poolThe memoryfrom whichthe allocatorallocates. Thisshould
% be disjointfrom all other liveallocators.
% allocatedGivesthe set of addressesthat have been allocatedby this
% allocator. Used to get the disjointnessof correctly
% allocatedvariables.
% private_memReturnsthose memoryregionsthat must not be changed
% for this allocatorto work properly.
% freed_sizeReturnsthe size of the block that willbe freed by
% a free in the same state. Needed to requirea correct
% adjustmentof the allocatedpredicateduringfree.
% We excludethe possibilityto allocate0 Byteshere (this is
% permittedby manymalloclibraries). We furtherrequirethat free
% makes a visiblechange in the allocatedpredicate. Some malloc
% libraries(or was it the C++ standard?) do not guaranteethat freed
% memoryis reallyfreed. We onlyrequirethat the predicateis changed
% (and not that freed memorycan be allocatedagain), nevertheless, this
% excludesemptyfree functions(such as in conservativegarbage
% collectors).

%

% One wouldexpecta validpredicate, whichis turnedon by initand
% maintainedafterwards. Thisvalidpredicatewouldsomehow classify
% the set of states in whichthe allocatoris expectedto work.
% However, the real methodsalloc and free
% have alwaysthe possibilityto returnfatal. The validpredicatewould
% onlyclutterthe specification, thereforewe keep it implicit.
% The set of states in whichthe allocatoris expectedto work is
% givenby the states predicateof the involvedplainmemory.
Allocator : Type = [#
memory_pool: [(plain_memory?) −> [State −> PRED[Address]]],
allocated : [(plain_memory?) −> [State −> PRED[Address]]],
private_mem: [(plain_memory?) −> PRED[Address]],
freed_size: [(plain_memory?) −> [Address −> [State −> lift[posnat]]]],
% init: [(plain_memory?) −> [State −> ExprResult[State, Unit]]],
alloc: [(plain_memory?) −>
[posnat −> [State −> ExprResult[State, Address]]]],
free: [(plain_memory?) −> [Address −> [State −> ExprResult[State, Unit]]]]

#]

% proof status:−)
% null_address_TCC1: TCCObligation
% HT: Thisshouldbe NULLfor an arbitrarypointertype, coming from
% the pointersemantics
null_address: Memory_Address= Mem(0)
% Requiredpropertiesof allocators:

68

B.2 allocators.pvs

% − allocatedis a subset of the memorypool
% − Newlyallocatedmemoryis disjointand comes from the memorypool.
% − If allocateand free succeed the allocatedpredicateis adjusted
% accordingly, whilethe memorypool staysconstant.
% − Freesucceeds preciselywhen freed_sizedoes.
% − Readingmemoryand writingmemoryat non−privateaddresses
% does not change the allocatedpredicateand the memorypool
% proof status:−)
% allocator?_TCC1: TCCObligation
% proof status:−)
% allocator?_TCC2: TCCObligation
% proof status:−)
% allocator?_TCC3: TCCObligation
% proof status:−)
% allocator?_TCC4: TCCObligation
% proof status:−)
% allocator?_TCC5: TCCObligation
% proof status:−)
% allocator?_TCC6: TCCObligation
% proof status:−)
% allocator?_TCC7: TCCObligation
% proof status:−)
% allocator?_TCC8: TCCObligation
allocator?(pm : (plain_memory?)) : PRED[Allocator] = Lambda(ac : Allocator) :
% privatememoryis in plainmemory−− thereforethe
% allocatorwon’t change underread access
subset?(ac‘private_mem(pm), union(pm‘ro_addr, pm‘rw_addr))

And

Forall(s : State) : pm‘states(s) Implies
% allocatefrom the memorypool
subset?(ac‘allocated(pm)(s), ac‘memory_pool(pm)(s)) And
% alloc properties
(Forall(size : posnat) :
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
disjoint?(ac‘allocated(pm)(s),
address_block(data(ac‘alloc(pm)(size)(s)), size))

And

ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))) =
union(ac‘allocated(pm)(s),

69 B PVS Theory Sources

address_block(data(ac‘alloc(pm)(size)(s)), size))

And

ac‘memory_pool(pm)(state(ac‘alloc(pm)(size)(s))) =
ac‘memory_pool(pm)(s))

And

% connectionof free <−−> freed_size
(Forall(addr : Address) :
OK?(ac‘free(pm)(addr)(s)) IFF up?(ac‘freed_size(pm)(addr)(s)))

And

% free properties
(Forall(addr : Address) :
OK?(ac‘free(pm)(addr)(s)) Implies
ac‘allocated(pm)(state(ac‘free(pm)(addr)(s))) =
difference(ac‘allocated(pm)(s),
address_block(addr, down(ac‘freed_size(pm)(addr)(s))))

And

ac‘memory_pool(pm)(state(ac‘free(pm)(addr)(s))) =
ac‘memory_pool(pm)(s))

And

% The privatememorycontainsthe state of the allocator. If
% it staysconstant, then the allocatoris unchanged.
(Forall(s2 : State) :
pm‘states(s2) And
stays_unchanged(pm)(s, s2, ac‘private_mem(pm))

Implies

ac‘memory_pool(pm)(s) = ac‘memory_pool(pm)(s2) And
ac‘allocated(pm)(s) = ac‘allocated(pm)(s2))

And

% next_stateinvariants
% (has_next_state(ac‘init(pm)(s)) Impliespm‘states(state(ac‘init(pm)(s))))
% And
(Forall(size : posnat) :
has_next_state (ac‘alloc(pm)(size)(s)) Implies
pm‘states(state(ac‘alloc(pm)(size)(s))))

And

(Forall(addr : Address) :
has_next_state (ac‘free(pm)(addr)(s)) Implies
pm‘states(state(ac‘free(pm)(addr)(s))))

And

% alloc and free onlychange privatememory, more precisely,
% onlywritableprivatememory
(Forall(size : posnat) :
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_address

Implies

only_changes(pm)(s, state(ac‘alloc(pm)(size)(s)),
ac‘private_mem(pm)))

70

B.2 allocators.pvs

And

(Forall(free_addr: Address) :
OK?(ac‘free(pm)(free_addr)(s)) Implies
only_changes(pm)(s, state(ac‘free(pm)(free_addr)(s)),
ac‘private_mem(pm)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% privatememoryis insideplainmemory

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_subset_private_memory_plain_memory : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm))) :
subset?(ac‘private_mem(pm), union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
allocator_private_memory_in_plain_memory : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), addr : Address) :
ac‘private_mem(pm)(addr) Implies
union(pm‘ro_addr, pm‘rw_addr)(addr)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% allocatefrom the memorypool

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_subset_allocated_memory_pool : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), s : State) :
pm‘states(s) Implies
subset?(ac‘allocated(pm)(s), ac‘memory_pool(pm)(s))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% alloc properties

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_alloc_disjoint: Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
disjoint?(ac‘allocated(pm)(s),

71 B PVS Theory Sources

address_block(data(ac‘alloc(pm)(size)(s)), size))
% proof status:−)
% allocator_allocated_alloc_TCC1 : TCCObligation
% proof status:−)
allocator_allocated_alloc: Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))) =
union(ac‘allocated(pm)(s),
address_block(data(ac‘alloc(pm)(size)(s)), size))
% proof status:−)
allocator_memory_pool_alloc : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
ac‘memory_pool(pm)(state(ac‘alloc(pm)(size)(s))) =
ac‘memory_pool(pm)(s)
% proof status:−)
allocator_subset_address_block_alloc_allocated : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_addressImplies
subset?(address_block(data(ac‘alloc(pm)(size)(s)), size),
ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% connectionof free <−−> freed_size

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_free_freed_size : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) Implies
(OK?(ac‘free(pm)(addr)(s)) IFF up?(ac‘freed_size(pm)(addr)(s)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

72

B.2 allocators.pvs

%

% free properties

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_allocated_free_TCC1 : TCCObligation
% proof status:−)
% allocator_allocated_free_TCC2 : TCCObligation
% proof status:−)
allocator_allocated_free: Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘free(pm)(addr)(s)) Implies
ac‘allocated(pm)(state(ac‘free(pm)(addr)(s))) =
difference(ac‘allocated(pm)(s),
address_block(addr, down(ac‘freed_size(pm)(addr)(s))))
% proof status:−)
allocator_memory_pool_free : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘free(pm)(addr)(s)) Implies
ac‘memory_pool(pm)(state(ac‘free(pm)(addr)(s))) =
ac‘memory_pool(pm)(s)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% constantprivatememoryimpliesmemory_pooland allocatedare constant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_const_private_memory_memory_pool : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), s1, s2 : State) :
pm‘states(s1) And
pm‘states(s2) And
stays_unchanged(pm)(s1, s2, ac‘private_mem(pm))

Implies

ac‘memory_pool(pm)(s1) = ac‘memory_pool(pm)(s2)
% proof status:−)
allocator_const_private_memory_allocated : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), s1, s2 : State) :
pm‘states(s1) And
pm‘states(s2) And
stays_unchanged(pm)(s1, s2, ac‘private_mem(pm))

73 B PVS Theory Sources

Implies

ac‘allocated(pm)(s1) = ac‘allocated(pm)(s2)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% next_stateinvariants

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_next_state_alloc_TCC1 : TCCObligation
% proof status:−)
allocator_next_state_alloc : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
has_next_state (ac‘alloc(pm)(size)(s)) Implies
pm‘states(state(ac‘alloc(pm)(size)(s)))
% proof status:−)
% allocator_next_state_free_TCC1 : TCCObligation
% proof status:−)
allocator_next_state_free : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
has_next_state (ac‘free(pm)(addr)(s)) Implies
pm‘states(state(ac‘free(pm)(addr)(s)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% alloc and free onlychange privatememory

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_only_changes_alloc_TCC1 : TCCObligation
% proof status:−)
allocator_only_changes_alloc : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_address

Implies

only_changes(pm)(s, state(ac‘alloc(pm)(size)(s)),
ac‘private_mem(pm))

74

B.2 allocators.pvs

% proof status:−)
% allocator_only_changes_free_TCC1 : TCCObligation
% proof status:−)
allocator_only_changes_free : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
free_addr: Address, s : State) :
pm‘states(s) And
OK?(ac‘free(pm)(free_addr)(s)) Implies
only_changes(pm)(s, state(ac‘free(pm)(free_addr)(s)),
ac‘private_mem(pm))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_readinvariant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_allocated_memory_read_TCC1 : TCCObligation
% proof status:−)
allocator_allocated_memory_read : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
ac‘allocated(pm)(state(memory_read(pm‘mem)(addr)(s))) =
ac‘allocated(pm)(s)
% proof status:−)
allocator_memory_pool_memory_read : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
ac‘memory_pool(pm)(state(memory_read(pm‘mem)(addr)(s))) =
ac‘memory_pool(pm)(s)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_writeinvariant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_stays_unchanged_memory_write_private_mem_TCC1 : TCCObligation
% proof status:−)
% allocator_stays_unchanged_memory_write_private_mem_TCC2 : TCCObligation

75 B PVS Theory Sources

% proof status:−)
allocator_stays_unchanged_memory_write_private_mem : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, byte : Byte, s : State) :
pm‘states(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr)

Implies

stays_unchanged(pm)(s, state(memory_write(pm‘mem)(addr, byte)(s)),
ac‘private_mem(pm))
% proof status:−)
allocator_allocated_memory_write : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, byte : Byte, s : State) :
pm‘states(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr) Implies
ac‘allocated(pm)(state(memory_write(pm‘mem)(addr, byte)(s))) =
ac‘allocated(pm)(s)
% proof status:−)
allocator_memory_pool_memory_write : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, byte : Byte, s : State) :
pm‘states(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr) Implies
ac‘memory_pool(pm)(state(memory_write(pm‘mem)(addr, byte)(s))) =
ac‘memory_pool(pm)(s)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% more complexproperties

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−)
allocator_subset_address_block_alloc_memory_pool : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_addressImplies
subset?(address_block(data(ac‘alloc(pm)(size)(s)), size),
ac‘memory_pool(pm)(s))

End Allocator

76

B.2 allocators.pvs

Allocation_Info[State : Type] : Theory
% Thistheoryformalizesthe (additional) informationthat
% we trackfor allocatorsand its consistencycondition.

Begin

Importing Allocator[State], More_Relations
% The allocationinfo containsthe set of allocationpointsof one
% specificallocator. An allocationpointis an (address, size) pair
% that has been allocatedwiththis veryallocator(that is, the
% addresswas returnedby an alloc withargumentsize in some former
% state and no free has been done so far.

%

% Note that the consistencybelow requiresonlythat the allocation
% info containsa subset of the allocatedmemory. In the following
% cases correctlyallocatedmemorymust not be in the allocationinfo:

%

% − Memoryallocatedin allocatorA that is used as memorypool of
% allocatorB.
Allocator_Info: Type = list[[Address, posnat]]
allocator_info? : PRED[Allocator_Info] = Lambda(ai : Allocator_Info) :
blocks_pairwise_disjoint (ai)
pm : Var (plain_memory?)
ai : Var Allocator_Info
s : Var State
consistent_allocator?(pm)(ac : (allocator?(pm)), ai)(s) : bool =
allocator_info?(ai) And
Forall(addr : Address, size : posnat) : member((addr, size), ai) Implies
subset?(address_block(addr, size), ac‘allocated(pm)(s))
% proof status:−)
consistent_allocator_state_change : Lemma
Forall(ac : (allocator?(pm)), s1, s2 : State) :
consistent_allocator?(pm)(ac, ai)(s1) And
ac‘allocated(pm)(s1) = ac‘allocated(pm)(s2) Implies
consistent_allocator?(pm)(ac, ai)(s2)

% proof status:−)
% consistent_allocator_read_TCC1 : TCCObligation
% proof status:−)
consistent_allocator_read: Lemma
Forall(ac : (allocator?(pm)), addr : Address) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
consistent_allocator?(pm)(ac, ai)(state(memory_read(pm‘mem)(addr)(s)))

77 B PVS Theory Sources

% proof status:−)
% consistent_allocator_write_TCC1 : TCCObligation
% proof status:−)
consistent_allocator_write: Lemma
Forall(ac : (allocator?(pm)), addr : Address, byte : Byte) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr) Implies
consistent_allocator?(pm)(ac, ai)
(state(memory_write(pm‘mem)(addr, byte)(s)))
% proof status:−)
% consistent_allocator_alloc_TCC1 : TCCObligation
% proof status:−)
consistent_allocator_alloc: Lemma
Forall(ac : (allocator?(pm)), size : posnat) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
consistent_allocator?(pm)
(ac, cons((data(ac‘alloc(pm)(size)(s)), size), ai))
(state(ac‘alloc(pm)(size)(s)))
% proof status:−)
% consistent_allocator_free_TCC1 : TCCObligation
% proof status:−)
% consistent_allocator_free_TCC2 : TCCObligation
% proof status:−)
consistent_allocator_free: Lemma
Forall(ac : (allocator?(pm)), addr : Address) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
OK?(ac‘free(pm)(addr)(s)) And
(member((addr, down(ac‘freed_size(pm)(addr)(s))), ai) OR

blocks_pairwise_disjoint

(

cons((addr, down(ac‘freed_size(pm)(addr)(s))), ai)))

Implies

consistent_allocator?(pm)
(ac, list_remove((addr, down(ac‘freed_size(pm)(addr)(s))), ai))
(state(ac‘free(pm)(addr)(s)))
End Allocation_Info

Allocation_Table[State : Type] : Theory

78

B.2 allocators.pvs

Begin

Importing Allocation_Info[State], Graph, Finite_Set_Reduce ,

More_List_Props_2

pm : Var (plain_memory?)
% An allocationtable containsa hierarchyof allocatorstogether
% withtheirallocationinfo’s. The hierarchyis a finite, directedgraph.
% hierarchy(ac1, ac2) means that the memorypool of ac2 is allocated
% insideac1. Currentlythe hierarchymust be a tree, that is a
% non−root allocatorgets its memoryfrom precieselyone allocator.
% ThusFiascosreagionmanageris currentlyunsupported.
Allocation_Table(pm) : Type = [#
hierarchy : (finite_tree?[(allocator?(pm))]),
info : [(hierarchy‘nodes) −> Allocator_Info]

#]

ai : Var Allocator_Info
s : Var State
allocation_ok?(pm)(at : Allocation_Table(pm), s) : bool =
(Forall(ac1, ac2 : (at‘hierarchy‘nodes)) :
at‘hierarchy‘edges(ac1, ac2) Implies
subset?(ac2‘memory_pool(pm)(s), ac1‘allocated(pm)(s)) And
block_is_free (ac2‘memory_pool(pm)(s), at‘info(ac1))

) And

(Forall(ac1, ac2, ac3 : (at‘hierarchy‘nodes)) :
at‘hierarchy‘edges(ac1, ac2) And
at‘hierarchy‘edges(ac1, ac3) Implies
ac2 = ac3 OR
disjoint?(ac2‘memory_pool(pm)(s), ac3‘memory_pool(pm)(s))

) And

(Forall(ac1, ac2 : (roots(at‘hierarchy))) :
ac1 = ac2 OR disjoint?(ac1‘memory_pool(pm)(s), ac2‘memory_pool(pm)(s)))

And

(Forall(ac1, ac2 : (at‘hierarchy‘nodes)) :
ac1 = ac2 OR disjoint?(ac1‘private_mem(pm), ac2‘private_mem(pm)))

And

(Forall(ac : (at‘hierarchy‘nodes)) :
consistent_allocator?(pm)(ac, at‘info(ac))(s))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% allocationaccess lemmas

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocation_finite_tree: Lemma
Forall(at : Allocation_Table(pm)) :

79 B PVS Theory Sources

finite_tree?(at‘hierarchy)
% proof status:−)
allocation_subnodes_allocated_and_free : Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) And
at‘hierarchy‘edges(ac1, ac2) Implies
subset?(ac2‘memory_pool(pm)(s), ac1‘allocated(pm)(s)) And
block_is_free (ac2‘memory_pool(pm)(s), at‘info(ac1))
% proof status:−)
allocation_subnodes_disjoint: Lemma
Forall(at : Allocation_Table(pm), ac1, ac2, ac3 : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) And
at‘hierarchy‘edges(ac1, ac2) And
at‘hierarchy‘edges(ac1, ac3) Implies
ac2 = ac3 OR
disjoint?(ac2‘memory_pool(pm)(s), ac3‘memory_pool(pm)(s))
% proof status:−)
allocation_roots_disjoint: Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (roots(at‘hierarchy))) :
allocation_ok?(pm)(at, s) Implies
ac1 = ac2 OR
disjoint?(ac1‘memory_pool(pm)(s), ac2‘memory_pool(pm)(s))
% proof status:−)
allocation_private_memory_disjoint : Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) Implies
ac1 = ac2 OR
disjoint?(ac1‘private_mem(pm), ac2‘private_mem(pm))
% proof status:−)
allocation_consistent_allocator: Lemma
Forall(at : Allocation_Table(pm), ac : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) Implies
consistent_allocator?(pm)(ac, at‘info(ac))(s)
% proof status:−)
allocation_allocated_allocation_point : Lemma
Forall(at: Allocation_Table(pm), ac : (at‘hierarchy‘nodes),
addr : Address, size : posnat) :
allocation_ok?(pm)(at, s) And
member((addr, size), at‘info(ac)) Implies
subset?(address_block(addr, size), ac‘allocated(pm)(s))
% proof status:−)
allocation_allocation_point_in_memory_pool : Lemma
Forall(at: Allocation_Table(pm), ac : (at‘hierarchy‘nodes),
addr : Address, size : posnat) :
pm‘states(s) And

80

B.2 allocators.pvs

allocation_ok?(pm)(at, s) And
member((addr, size), at‘info(ac)) Implies
subset?(address_block(addr, size), ac‘memory_pool(pm)(s))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% generalutilitylemmas

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−)
allocators_different_in_hierachy : Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
at‘hierarchy‘edges(ac1, ac2) Implies
Not ac1 = ac2
% proof status:−)
uppath_memory_pool: Lemma
Forall(at : Allocation_Table(pm), p : (path?(at‘hierarchy))) :
allocation_ok?(pm)(at, s) And
pm‘states(s) Implies
subset?(path_end(p)‘memory_pool(pm)(s),
path_start(p)‘memory_pool(pm)(s))
% proof status:−)
% uppath_memory_pool_allocated_and_free_TCC1 : TCCObligation
% proof status:−)
uppath_memory_pool_allocated_and_free : Lemma
Forall(at : Allocation_Table(pm), p : (path?(at‘hierarchy))) :
pm‘states(s) And
allocation_ok?(pm)(at, s) And
length(p) >= 2 Implies
subset?(path_end(p)‘memory_pool(pm)(s), path_start(p)‘allocated(pm)(s))

And

block_is_free (path_end(p)‘memory_pool(pm)(s), at‘info(path_start(p)))
% proof status:−)
allocation_memory_pools: Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
pm‘states(s) And
allocation_ok?(pm)(at, s) Implies
ac1 = ac2

OR

disjoint?(ac1‘memory_pool(pm)(s), ac2‘memory_pool(pm)(s))

OR

(subset?(ac1‘memory_pool(pm)(s), ac2‘allocated(pm)(s)) And
block_is_free (ac1‘memory_pool(pm)(s), at‘info(ac2)))

OR

(subset?(ac2‘memory_pool(pm)(s), ac1‘allocated(pm)(s)) And

81 B PVS Theory Sources

block_is_free (ac2‘memory_pool(pm)(s), at‘info(ac1)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% generalallocationresults

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocation_info_TCC1: TCCObligation
allocation_info(pm)(at : Allocation_Table(pm)) : Allocator_Info=
flatten(map(at‘info)(list_of_finite_set (at‘hierarchy‘nodes)))
% proof status:−)
member_allocation_info: Lemma
Forall(at : Allocation_Table(pm), addr : Address, size : posnat) :
member((addr, size), allocation_info(pm)(at)) Implies
Exists(ac : (at‘hierarchy‘nodes)) : member((addr, size), at‘info(ac))
% all allocationpointsare disjoint
% proof status:−)
allocation_consistent: Lemma
Forall(at : Allocation_Table(pm)) :
pm‘states(s) And
allocation_ok?(pm)(at, s) Implies
allocator_info?(allocation_info(pm)(at))
% proof status:−)
% allocation_alloc_other_private_memory_TCC1 : TCCObligation
% proof status:−)
% allocation_alloc_other_private_memory_TCC2 : TCCObligation
% proof status:−)
allocation_alloc_other_private_memory : Lemma
Forall(at : Allocation_Table(pm),
ac1, ac2 : (at‘hierarchy‘nodes), size : posnat) :
pm‘states(s) And
allocation_ok?(pm)(at, s) And
OK?(ac1‘alloc(pm)(size)(s)) And
Not data(ac1‘alloc(pm)(size)(s)) = null_addressAnd
Not ac1 = ac2 Implies
stays_unchanged(pm)(s, state(ac1‘alloc(pm)(size)(s)),
ac2‘private_mem(pm))
% proof status:−)
% allocation_alloc_TCC1: TCCObligation
% proof status:−)
allocation_alloc: Lemma

82

B.3 bits.pvs

Forall(at : Allocation_Table(pm),
ac : (at‘hierarchy‘nodes), size : posnat) :
pm‘states(s) And
allocation_ok?(pm)(at, s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
allocation_ok?(pm)(
at WITH [‘info(ac) :=
cons((data(ac‘alloc(pm)(size)(s)), size), at‘info(ac))],
state(ac‘alloc(pm)(size)(s)))
End Allocation_Table

B.3 bits.pvs

Bits : Theory

Begin

Importing Alignment
% MV: do we need the size limitatsany more
n, i : Var nat
bool_to_nat (b : bool) : nat = if b then 1 else 0 endif
% proof status:−)
bool_to_nat_below : Judgement bool_to_nat (b : bool) HAS_TYPEbelow(2)
nat_to_bool (n : below(2)) : bool = n = 1
% proof status:−)
nat_bool_iso: Lemma Forall(b : bool) : nat_to_bool (bool_to_nat (b)) = b
% returntrue if the i−th bit in n is 1
cut_bit(n, i) : bool = rem(2)(ndiv(n, expt(2, i))) = 1
% proof status:−)
cut_bit_zero: Lemma cut_bit(0, i) = False
% cut k bits out of n, startingat i
cut_bits(n, i, k : nat) : nat =
rem(expt(2, k))(ndiv(n, expt(2, i)))
% proof status:−)
cut_bits_below: Judgement cut_bits(n, i, k : nat)
HAS_TYPEbelow(expt(2, k))
% proof status:−)
cut_bits_aligned: Lemma Forall(n, i, k : nat) :
i <= k And cut_bits(n, 0, k) = 0 Implies aligned?(i)(n)
% proof status:−)

83 B PVS Theory Sources

aligned_cut_bits: Lemma Forall(n, i, j : nat, k : nat) :
i + j <= k And aligned?(k)(n) Implies
cut_bits(n, i, j) = 0
% proof status:−)
aligned_add_cut_bits : Lemma Forall(n, m, i, j, k : nat) :
i + j <= k And aligned?(k)(n) Implies
cut_bits(n + m, i, j) = cut_bits(m, i, j)
% proof status:−)
cut_bit_bits: Lemma
cut_bit(n, i) = IF cut_bits(n, i, 1) = 1 Then true Else false Endif
% proof status:−)
cut_bits_zero: Lemma Forall(i, k : nat) : cut_bits(0, i, k) = 0
% proof status:−)
zero_cut_bits: Lemma Forall(n, i, k : nat) : k = 0 Implies
cut_bits(n, i, k) = 0
% proof status:−)
% cut_bits_cut_bits_TCC1 : TCCObligation
% proof status:−)
cut_bits_cut_bits : Lemma
Forall(n, i1, k1, i2, k2 : nat) :
cut_bits(cut_bits(n, i1, k1), i2, k2) =
IF i2 >= k1 Then 0
Elsif i2 + k2 > k1 Then cut_bits(n, i1 + i2, k1 − i2)
Else cut_bits(n, i1 + i2, k2)

Endif

% proof status:−)
cut_bit_cut_bits : Lemma
Forall(n, i1, k1, i2 : nat) :
cut_bit(cut_bits(n, i1, k1), i2) =
IF i2 >= k1 Then False
Else cut_bit(n, i1 + i2)

Endif

shift_bits_left (n, i) : nat = n ∗ expt(2, i)
% proof status:−)
% shift_bits_left_less_TCC1 : TCCObligation
% proof status:−)
shift_bits_left_less : Lemma Forall(n, i, k : nat) :
k >= i And n < expt(2, k − i) Implies
shift_bits_left (n, i) < expt(2, k)
% proof status:−)

84

B.3 bits.pvs

aligned_shift_bits_ok : Lemma Forall(n, i, j : nat) :
i <= j Implies
aligned?(i)(shift_bits_left (n, j))
% proof status:−)
% aligned_shift_bits_reduce_TCC1 : TCCObligation
% proof status:−)
aligned_shift_bits_reduce : Lemma Forall(n, i, j : nat) :
i > j And aligned?(i − j)(n) Implies
aligned?(i)(shift_bits_left (n, j))
shift_bits_right (n, i) : nat = ndiv(n, expt(2, i))
% proof status:−)
% overwrite_bits_TCC1: TCCObligation
% overwrite_bits(n, m, i, j)
% replacesk bits startingfrom i in word n
% withk bits startingat i in word m
overwrite_bits(n, m, i, k : nat) : nat =
n − rem(expt(2, i + k))(n)
+ shift_bits_left (cut_bits(m, i, k), i)
+ rem(expt(2, i))(n)
% proof status:−)
overwrite_bits_less: Lemma Forall(n, m, i, k, j : nat) :
n < expt(2, j) And i + k <= j Implies
overwrite_bits(n, m, i, k) < expt(2, j)
overwrite_bit(n, m, i : nat) : nat = overwrite_bits(n, m, i, 1)
% proof status:−)
overwrite_bit_less: Lemma Forall(n, m, i, k : nat) :
n < expt(2, k) And i < k Implies
overwrite_bit(n, m, i) < expt(2, k)

% overwritesbit i in n withb
overwrite_bool_bit (n : nat, b : bool, i : nat) : nat =
overwrite_bit(n, shift_bits_left (bool_to_nat (b), i), i)
% proof status:−)
overwrite_bool_bit_less : Lemma Forall(n : nat, b : bool, i, k : nat) :
n < expt(2, k) And i < k Implies
overwrite_bool_bit (n, b, i) < expt(2, k)

% overwritek bits in n at indexi withthe firstk bits from m
overwrite_shift_bits (n, m, i : nat, k : nat) : nat =
overwrite_bits(n, shift_bits_left (m, i), i, k)

85 B PVS Theory Sources

% proof status:−)
overwrite_shift_bits_less : Lemma Forall(n, m, i, k, j : nat) :
n < expt(2, j) And i + k <= j Implies
overwrite_shift_bits (n, m, i, k) < expt(2, j)
% proof status:−)
aligned_overwrite_shift_bits_more : Lemma
Forall(a, n, m, i : nat, k : posnat) :
a <= i And aligned?(a)(n) Implies
aligned?(a)(overwrite_shift_bits (n, m, i, k))

% proof status:−)
% aligned_overwrite_shift_bits_less_TCC1 : TCCObligation
% the aligned(a)(n) is a verystrong assumptions,
% closer to necessitywouldbe
% aligned(a)(delete bits i to i + k −1 in n)
% proof status:−)
aligned_overwrite_shift_bits_less : Lemma
Forall(a, n, m, i : nat, k : posnat) :
i < a And aligned?(a)(n) And aligned?(a − i)(m) Implies
aligned?(a)(overwrite_shift_bits (n, m, i, k))

% proof status:−)
% cut_bits_shift_bits_left_TCC1 : TCCObligation
% proof status:−)
% cut_bits_shift_bits_left_TCC2 : TCCObligation
% Don’t installcut_bits_shift_bits_left as auto rewrite,
% it can be circularfor ci = 0. Use the lemmasbelow instead.
% proof status:−)
cut_bits_shift_bits_left : Lemma Forall(n, si, ci, ck : nat) :
cut_bits(shift_bits_left (n, si), ci, ck) =
If ci + ck <= si Then 0
Elsif ci < si
Then cut_bits(shift_bits_left (n, si − ci), 0, ck)
Else cut_bits(n, ci − si, ck)

Endif

% proof status:−)
cut_bits_shift_bits_left_outside : Lemma
Forall(n, si, ci, ck : nat) :
ci + ck <= si Implies
cut_bits(shift_bits_left (n, si), ci, ck) = 0
% proof status:−)
% cut_bits_shift_bits_left_overlap_TCC1 : TCCObligation

86

B.3 bits.pvs

% proof status:−)
cut_bits_shift_bits_left_overlap : Lemma
Forall(n, si, ci, ck : nat) :
ci + ck > si And ci < si And ci > 0 Implies
cut_bits(shift_bits_left (n, si), ci, ck) =
cut_bits(shift_bits_left (n, si − ci), 0, ck)
% proof status:−)
cut_bits_shift_bits_left_in : Lemma
Forall(n, si, ci, ck : nat) :
ci >= si Implies
cut_bits(shift_bits_left (n, si), ci, ck) =
cut_bits(n, ci − si, ck)

% proof status:−)
overwrite_shift_bits_zero : Lemma
Forall(z, m, i, k : nat) :
z = 0 Implies
overwrite_shift_bits (z, m, i, k) =
shift_bits_left (cut_bits(m, 0, k), i)
% proof status:−)
zero_overwrite_shift_bits : Lemma
Forall(n, m, i, k : nat) : k = 0 Implies
overwrite_shift_bits (n, m, i, k) = n
% proof status:−)
% bit_split_TCC1: TCCObligation
% proof status:−)
bit_split: Lemma Forall(n, i, k : nat) :
k <= i And n < expt(2, i) Implies
n = overwrite_shift_bits (cut_bits(n, 0, k),
cut_bits(n, k, i − k), k, i − k)
% proof status:−)
shift_bits_left_cut_bits : Lemma Forall(n, i, k, j : nat) :
i = j And aligned?(i)(n) And n < expt(2, i + k) Implies
shift_bits_left (cut_bits(n, i, k), j) = n
% proof status:−)
cut_bits_0_to_below : Lemma Forall(n, k : nat) :
n < expt(2, k) Implies cut_bits(n, 0, k) = n
% proof status:−)
cut_bits_overwrite_bits_disjoined : Lemma
Forall(n, m, oi, ok : nat, ci, ck : nat) :
oi + ok <= ci Or ci + ck <= oi Implies
cut_bits(overwrite_bits(n, m, oi, ok), ci, ck) = cut_bits(n, ci, ck)
% proof status:−)

87 B PVS Theory Sources

cut_bits_overwrite_bool_bit_disjoined : Lemma
Forall(n : nat, b : bool, oi, ci, ck : nat) :
oi < ci Or ci + ck <= oi Implies
cut_bits(overwrite_bool_bit (n, b, oi), ci, ck) = cut_bits(n, ci, ck)

% proof status:−)
cut_bits_overwrite_bits_contained : Lemma
Forall(n, m, oi, ok, ci, ck : nat) :
oi <= ci And ci + ck <= oi + ok Implies
cut_bits(overwrite_bits(n, m, oi, ok), ci, ck) =
cut_bits(m, ci, ck)
% proof status:−)
cut_bits_overwrite_shift_bits_disjoint : Lemma
Forall(n, m, i1, k1, i2, k2 : nat) :
i1 + k1 <= i2 OR i2 + k2 <= i1 Implies
cut_bits(overwrite_shift_bits (n, m, i1, k1), i2, k2) =
cut_bits(n, i2, k2)
% proof status:−)
% cut_bits_overwrite_shift_bits_contained_TCC1 : TCCObligation
% proof status:−)
cut_bits_overwrite_shift_bits_contained : Lemma
Forall(n, m, i1, k1, i2, k2 : nat) :
i1 <= i2 And i2 + k2 <= i1 + k1 Implies
cut_bits(overwrite_shift_bits (n, m, i1, k1), i2, k2) =
cut_bits(m, i2 − i1, k2)
% proof status:−)
% cut_bit_overwrite_shift_bits_TCC1 : TCCObligation
% proof status:−)
cut_bit_overwrite_shift_bits : Lemma
Forall(n, m, i1, k1, i2 : nat) :
cut_bit(overwrite_shift_bits (n, m, i1, k1), i2) =
IF i1 <= i2 And i2 < i1 + k1
Then cut_bit(m, i2 − i1)
Else cut_bit(n, i2)

Endif

% not needed any more, proof savedbelow
% cut_bits_overwrite_bool_bit_contained : Lemma
% Forall(n : nat, b : bool, oi : nat, ci, ck : nat) :
% ck = 1 Andoi = ci Implies
% cut_bits(overwrite_bool_bit (n, b, oi), ci, ck) =
% bool_to_nat(b)
% proof status:−)
cut_bit_overwrite_bool_bit : Lemma
Forall(n : nat, b : bool, i, j : nat) :

88

B.3 bits.pvs

cut_bit(overwrite_bool_bit (n, b, i), j) =
IF i = j Then b
Else cut_bit(n, j)

Endif

% proof status:−)
overwrite_shift_bits_merge : Lemma
Forall(m, ci1, ck1, si, ci2, ck2, os, ok : nat) :
ci1 + ck1 = ci2 And
si + ck1 = os And
ck2 = ok

Implies

overwrite_shift_bits (shift_bits_left (cut_bits(m, ci1, ck1), si),
cut_bits(m, ci2, ck2), os, ok) =
shift_bits_left (cut_bits(m, ci1, ck1 + ck2), si)
End Bits

% Bit operationsfor below[2^p]
Bitops[p : posnat] : Theory

Begin

Importing Bits, More_List_Props
n : Var nat
val : Var nat
v1, v2 : Var nat
bit_set?(n, val) : bool = cut_bit(val, n)
% proof status:−)
bit_set_zero_mask : Lemma
Forall (n : nat) : Not bit_set?(n, 0)
% proof status:−)
bit_set_ndiv_expt2 : Lemma
Forall (n, val, m : nat) :
bit_set?(n, ndiv(val, expt(2, m))) = bit_set?(n + m, val)
% proof status:−)
% bit_set_full_mask_TCC1 : TCCObligation
% proof status:−)
bit_set_full_mask : Lemma
Forall (n : nat) : n < p Implies bit_set?(n, expt(2, p) − 1)
% proof status:−)
bits_equal: Lemma
Forall (v1, v2, p : nat) :
(Forall (n : nat) : n < p Implies bit_set?(n, v1) = bit_set?(n, v2)) Implies
rem(expt(2, p))(v1) = rem(expt(2, p))(v2)

89 B PVS Theory Sources

% proof status:−)
bits_equal2: Lemma
Forall (v1, v2 : below[expt(2, p)]) :
(Forall (n : nat) : n < p Implies bit_set?(n, v1) = bit_set?(n, v2)) IFF
v1 = v2
% proof status:−)
bits_equal3: Lemma
Forall (v1, v2 : nat) :
(Forall (n : nat) : bit_set?(n, v1) = bit_set?(n, v2)) Implies
v1 = v2
% proof status:−)
bits_equal4: Lemma
Forall (v1, v2 : nat, m : nat) :
(Forall (n : nat) : n >= m Implies bit_set?(n, v1) = bit_set?(n, v2)) Implies
ndiv(v1, expt(2, m)) = ndiv(v2, expt(2, m))
set_bit(n, val) : nat =
If bit_set?(n, val) Then

val Else

val + expt(2,n)

Endif

% proof status:−)
% clear_bit_TCC1: TCCObligation
clear_bit(n, val) : nat =
If bit_set?(n, val) Then
val − expt(2,n)

Else val Endif

change_bit(val : nat, c : [nat −> bool])(n : nat) : nat =
If c(n) Then
set_bit(n, val)

Else

clear_bit(n, val)

Endif

% proof status:−)
change_bit_single_bit_op : Lemma
Forall (n, m, v : nat, c : [nat −> bool]) : n /= m Implies
bit_set?(n, v) = bit_set?(n, change_bit(v, c)(m))
% proof status:−)
change_bit_result: Lemma
Forall (n, v : nat, c : [nat −> bool]) :
bit_set?(n, change_bit(v, c)(n)) = c(n)

90

B.3 bits.pvs

% proof status:−)
% change_bits_TCC1: TCCObligation
% proof status:−)
% change_bits_TCC2: TCCObligation
change_bits(v : nat, c : [nat −> bool])(n : nat) : Recursive nat =
If n = 0 Then
change_bit(v, c)(0)

Else

change_bit(change_bits(v, c)(n − 1), c)(n)

Endif

Measure n
% proof status:−)
change_bits_result: Lemma
Forall (m, n : nat, val : nat, c : [nat −> bool]) : m <= n Implies
bit_set?(m, change_bits(val, c)(n)) = c(m)
% proof status:−)
change_bits_unchanged: Lemma
Forall (m, n : nat, val : nat, c : [nat −> bool]) : m > n Implies
bit_set?(m, change_bits(val, c)(n)) = bit_set?(m, val)
% proof status:−)
% change_bits_below_TCC1 : TCCObligation
% proof status:−)
change_bits_below: Lemma
Forall (v : below[expt(2, p)], c : [nat −> bool]) :
change_bits(v, c)(p−1) < expt(2, p)
% proof status:−)
% binary_not_TCC1: TCCObligation
% binaryops
% −−−−−−−−−−−−
binary_not(val : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(val, Lambda (n : nat) : Not bit_set?(n, val))(p − 1)
% proof status:−)
binary_not_not: Lemma
Forall ( val : below[expt(2, p)]) :
binary_not(binary_not(val)) = val
% proof status:−)
% binary_and_TCC1: TCCObligation
binary_and(v1, v2 : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(v1, Lambda (n : nat) : bit_set?(n, v1) And bit_set?(n, v2))(p − 1)

91 B PVS Theory Sources

% proof status:−)
binary_and_not: Lemma
Forall (val : below[expt(2, p)]) :
binary_and(val, binary_not(val)) = 0
% proof status:−)
% binary_and_full_TCC1 : TCCObligation
% proof status:−)
binary_and_full: Lemma
Forall (val : below[expt(2, p)]) :
binary_and(val, expt(2, p) − 1) = val
% proof status:−)
% binary_and_zero_TCC1 : TCCObligation
% proof status:−)
binary_and_zero: Lemma
Forall (val : below[expt(2, p)]) :
binary_and(val, 0) = 0
% proof status:−)
% binary_or_TCC1: TCCObligation
binary_or(v1, v2 : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(v1, Lambda (n : nat) : bit_set?(n, v1) Or bit_set?(n, v2))(p − 1)
% proof status:−)
binary_or_not: Lemma
Forall (val : below[expt(2, p)]) :
binary_or(val, binary_not(val)) = expt(2, p) − 1
% proof status:−)
% binary_xor_TCC1: TCCObligation
binary_xor(v1, v2 : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(v1, Lambda (n : nat) : bit_set?(n, v1) /= bit_set?(n, v2))(p − 1)
% proof status:−)
binary_xor_self: Lemma
Forall (val : below[expt(2, p)]) :
binary_xor(val, val) = 0
% proof status:−)
binary_or_full: Lemma
Forall (val : below[expt(2, p)]) :
binary_or(val, expt(2, p) − 1) = expt(2, p) − 1
% proof status:−)
binary_or_zero: Lemma
Forall (val : below[expt(2, p)]) :
binary_or(val, 0) = val

92

B.3 bits.pvs

End Bitops
Bitlist_ops: Theory

Begin

Importing General, Bitops[bits_per_byte ]
% Liftingto lists
% ==================
% proof status:−)
% binary_not_TCC1: TCCObligation
binary_not(l : list[Byte]) : list[Byte] =
map[Byte, Byte](binary_not)(l)
% proof status:−)
% binary_and_TCC1: TCCObligation
binary_and(l1, l2 : list[Byte]) : list[Byte] =
map2[Byte](binary_and)(l1, l2)
% proof status:−)
% binary_or_TCC1: TCCObligation
binary_or(l1, l2 : list[Byte]) : list[Byte] =
map2[Byte](binary_or)(l1, l2)
% proof status:−)
% binary_xor_TCC1: TCCObligation
binary_xor(l1, l2 : list[Byte]) : list[Byte] =
map2[Byte](binary_xor)(l1, l2)
full_mask?(size : nat)(l : list[Byte]) : bool =
length(l) = size And every(Lambda (t : Byte) : t = max_byte− 1)(l)
zero_mask?(size : nat)(l : list[Byte]) : bool =
length(l) = size And every(Lambda (t : Byte) : t = 0)(l)
% proof status:−)
singleton_zero_mask: Lemma
Forall (s : nat) :
singleton?(zero_mask?(s))
% proof status:−)
% bit_set?_TCC1: TCCObligation
% proof status:−)
% bit_set?_TCC2: TCCObligation

93 B PVS Theory Sources

bit_set?(n : nat, l : list[Byte]) : bool =
If n < length(l) ∗ max_byteThen
bit_set?(rem(max_byte)(n), nth(l, ndiv(n, max_byte)))

Else false Endif

apply_bitop_valuefield (mask : list[Byte], bitop : [list[Byte] −> list[Byte]])(l : list[Byte]) : list[Byte] =
binary_or(binary_and(l, binary_not(mask)), binary_and(bitop(l), mask))
End Bitlist_ops

B.4 challenge-linear.pvs

% MV: there are a few assumptionsin the addressin page table range stuff

%

% CurrentAddressSpace Layout(hypervisor/include/memory.h)

%

% | GlobalArea| CPULocalArea| AS Loc|
% |−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−|
% |−−−−−−− −−−−−−−−−−−−−−−−− −− −−− −−−−−− −−−− −−−−− −− −−−−−− −−−−−−−|
% | Kcode | Mem Pool | |RM|VGA|IOAPIC| Loc| |LAPIC|SP|CPULoc| IOPBM|
% |−−−−−−− −−−−−−−−−−−−−−−−− −− −−− −−−−−− −−−− −−−−− −− −−−−−− −−−−−−−|
% |−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−|

%

% HV: Assumptions
% − The globalarea is syncedat the masterPDIRlevel(fault.cpp/paging.cpp).
% − MasterPDIRis in Kcode (.bss segment)

%

% Model:
% − address_in_page_table_range gives all page table entriesused for the given
% addressrange. Page table entriesoutsidethis range may be in plainmemory
% − this shouldat least allowto enter the fault handlerwithoutloosing plain
% memorybecause subset(ro_PFu rw_PF, ro u rw)
% ? is this a generic resultfor plainmemory, i.e., pm(range) => pm(sub_range)
% and if so do we have it.
Linear_Memory_Blessing [% the underlyingphysicalmemory
Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory] : Theory

Begin

Importing Linear_Memory[Physical_memory, pm_phy],
Memory_Change, Control_Register_Datatype
oact : Var PRED[[Linear_memory−> SuperResult[Linear_memory]]]
ro_addr: Var PRED[Memory_Address_4G ]
rw_addr: Var PRED[Memory_Address_4G ]
states : Var PRED[Linear_memory]
linear_range: Var PRED[Memory_Address_4G ]

94

B.4 challenge-linear.pvs

s : Var Linear_memory
lvl : Var Level

% Sharing
% =========
% tuplesof linearaddressesthat share the same physicaladdress
linear_shared?(s)(a1, a2 : Memory_Address_4G ) : bool =
Exists(ac1, ac2 : Memory_access) :
OK?(linear_resolve(a1, ac1)(s)) And
OK?(linear_resolve(a2, ac2)(s)) And
data(linear_resolve(a1, ac1)(s)) =
data(linear_resolve(a2, ac2)(s))
% AddressIn Page Table
% =======================
% proof status:−)
% PTab_Address_TCC1: TCCObligation
PTab_Address: Type =
{a : Memory_Address_4G| aligned?(bits_per_level+ pe_size)(offset(a))}
% proof status:−)
% pe_in_pdir_range ?_TCC1: TCCObligation
pe_in_pdir_range ?(s, linear_range)(phy_a: Memory_Address_4G ) : bool =
Let res = read_data(pm_phy, pdbr_data_type )(PDBR)(s) In
OK?(res) And
Exists (lin_a: (linear_range)) :
xlat_idx(pdir_lvl, data(res)‘base_addr, lin_a) = phy_a
% proof status:−)
% pe_in_ptab_range ?_TCC1: TCCObligation
% proof status:−)
% pe_in_ptab_range ?_TCC2: TCCObligation
% proof status:−)
% pe_in_ptab_range ?_TCC3: TCCObligation
% proof status:−)
% pe_in_ptab_range ?_TCC4: TCCObligation
pe_in_ptab_range ?(s, linear_range)(phy_a: Memory_Address_4G ) : bool =
Exists (pde : (pe_in_pdir_range ?(s, linear_range))) :
Exists (lin_a: (linear_range)) :
Let res = read_data(pm_phy, paging_data_type (pdir_lvl))(pde)(s) In
OK?(res) And pde_pt?(pdir(data(res))) And

95 B PVS Theory Sources

xlat_idx(ptab_lvl, base(data(res)), lin_a) = phy_a
% proof status:−)
% pe_in_pt_range ?_TCC1: TCCObligation
% proof status:−)
% pe_in_pt_range ?_TCC2: TCCObligation
pe_in_pt_range ?(s, linear_range, lvl)(phy_a: Memory_Address_4G ) : bool =

Cond

lvl = pdir_lvl−> pe_in_pdir_range ?(s, linear_range)(phy_a),
lvl = ptab_lvl−> pe_in_ptab_range ?(s, linear_range)(phy_a)

EndCond

% proof status:−)
pe_in_pt_range_aligned : Lemma
Forall (phy_a: Memory_Address_4G ) :
pe_in_pt_range ?(s, linear_range, lvl)(phy_a) Implies
aligned?(pe_size)(offset(phy_a))
address_in_pt_range ?(s, linear_range)(phy_a: Memory_Address_4G ) : bool =
Exists (pe : Memory_Address_4G , lvl : Level) :
pe_in_pt_range ?(s, linear_range, lvl)(pe) And
address_block(pe, expt(2, pe_size))(phy_a)
% proof status:−)
pe_in_pt_address_in_pt : Lemma
Forall (base : Memory_Address_4G ) :
pe_in_pt_range ?(s, linear_range, lvl)(base)

Implies

subset?(address_block(base, expt(2, pe_size)),
address_in_pt_range ?(s, linear_range))
% PhysicalAddresses
% ====================
virt_to_phys_range (s : Linear_memory, linear_range: PRED[Memory_Address_4G ],
mem_ac: PRED[Memory_access])
(phy_a: Memory_Address_4G ) : bool =
Exists (lin_a: (linear_range), ac : (mem_ac)) :
Let res = linear_resolve(lin_a, ac)(s) In
OK?(res) And data(res) = phy_a
virt_to_phys_range (s, linear_range) : [Memory_Address_4G−> bool] =
virt_to_phys_range (s, linear_range, fullset[Memory_access])
% LinearResolveTransformers
% =============================

linear_resolve_register_transformers

(q : [Physical_memory−> SuperResult[Physical_memory]]) : bool =
q = expr_2_super (read_data(pm_phy, segment_reg_data_type )(CS)) Or

96

B.4 challenge-linear.pvs

q = expr_2_super (read_data(pm_phy, pdbr_data_type )(PDBR)) Or
Exists (a : Memory_Address_4G ) :
q = expr_2_super (write_data(pm_phy, address_data_type )(CR2, a))
% LinearBlessing
% =================
% Those page table entriesthat are used to translatethe address
% range for whichlinearmemoryis definedare not partof the
% linearblessedrange. Thisis because as partof the translation,
% referencebits in this area may be updated. OtherPTEsnot involved
% in the translationmay well be partof plainmemory.

%

% Thislets the page fault handlerwork insideplainmemoryand update
% the activekernelpage table in all areas besidesthe one in whichthe
% page−fault handleritself runs.
% make in memoryexplicitrequirement!!!
linear_blessed?(s, ro_addr, rw_addr) : bool =
% resolveOK?
(Forall (a : Memory_Address_4G ) : union(ro_addr, rw_addr)(a) Implies
OK?(linear_resolve(a, Read)(s)) And OK?(linear_resolve(a, Execute)(s)))

And

(Forall (a : Memory_Address_4G ) : rw_addr(a) Implies
OK?(linear_resolve(a, Write)(s))) And
% underlyingblessingmemoryread addresses
subset?(virt_to_phys_range (s, union(ro_addr, rw_addr),
union(singleton(Read), singleton(Execute))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))

And

subset?(virt_to_phys_range (s, rw_addr, singleton(Write)), pm_phy‘rw_addr)

And

subset?(address_in_pt_range ?(s, union(ro_addr, rw_addr)), pm_phy‘rw_addr)

And

% disjointmappingof (ro_addr, rw_addr) and ptabs
disjoint?(virt_to_phys_range (s, union(ro_addr, rw_addr)),
address_in_pt_range ?(s, union(ro_addr, rw_addr)))

And

% not shared
% blessingmemoryread, memory_writeaddressesif these are disjoint
(Forall (a1, a2 : Memory_Address_4G ) :
rw_addr(a1) And union(ro_addr, rw_addr)(a2) Implies
Not linear_shared?(s)(a1, a2)) And
% linearmemoryside effects
True % no side effect restrictions
% proof status:−)
% is_linear_plain_memory ?_TCC1: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC2: TCCObligation

97 B PVS Theory Sources

% proof status:−)
% is_linear_plain_memory ?_TCC3: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC4: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC5: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC6: TCCObligation
is_linear_plain_memory ?(pm : Plain_Memory[Linear_memory]) : bool =
% linearpm
pm‘mem = linear_pmAnd
% unmodifiedpage−table area
% cs
(Forall (s : (pm‘states)) :
OK?(read_data(pm_phy, segment_reg_data_type )(CS)(s))) And
(Forall (s1, s2 : (pm‘states)) :
data(read_data(pm_phy, segment_reg_data_type )(CS)(s1)) =
data(read_data(pm_phy, segment_reg_data_type )(CS)(s2))) And
% pdbr
(Forall (s : (pm‘states)) :
OK?(read_data(pm_phy, pdbr_data_type )(PDBR)(s))) And
(Forall (s1, s2 : (pm‘states)) :
data(read_data(pm_phy, pdbr_data_type )(PDBR)(s1)) =
data(read_data(pm_phy, pdbr_data_type )(PDBR)(s2))) And
% pdirrange
(Forall (s1, s2 : (pm‘states)) :
pe_in_pdir_range ?(s1, union(pm‘ro_addr, pm‘rw_addr)) =
pe_in_pdir_range ?(s2, union(pm‘ro_addr, pm‘rw_addr)) And
pe_in_ptab_range ?(s1, union(pm‘ro_addr, pm‘rw_addr)) =
pe_in_ptab_range ?(s2, union(pm‘ro_addr, pm‘rw_addr))) And
% page tables
(Forall (s : (pm‘states), lvl : Level,
a : (pe_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr), lvl))) :
OK?(read_data(pm_phy, paging_data_type (lvl))(a)(s))) And
(Forall (s1, s2 : (pm‘states), lvl : Level,
a : (pe_in_pt_range ?(s1, union(pm‘ro_addr, pm‘rw_addr), lvl))) :
set_reference(data(read_data(pm_phy, paging_data_type (lvl))(a)(s1)),
Write) =
set_reference(data(read_data(pm_phy, paging_data_type (lvl))(a)(s2)),
Write)) And
% underlyingblessedmemory
plain_memory?(pm_phy) And
% underlyingstates
pm‘states = pm_phy‘states And
% underlyingother actions
subset?(pm‘other_actions, pm_phy‘other_actions) And
subset?(linear_resolve_register_transformers , pm_phy‘other_actions) And
% memoryaddressrange

98

B.4 challenge-linear.pvs

(Forall (a : (union(pm‘ro_addr, pm‘rw_addr))) :
Mem?(type_of(a)) And 0 <= offset(a) And
offset(a) < max_linear_offset ) And
% linear_blessedstates
(Forall (s : (pm‘states)) : linear_blessed?(s, pm‘ro_addr, pm‘rw_addr))
% %%%%%%%%  PlainMemoryStructurefor LinearMemory%%%%%%%%%%%
linear_plain_memory (states, oact, ro_addr, rw_addr)
: Plain_Memory[Linear_memory] =

(#

mem := linear_pm,
states := states,
ro_addr:= ro_addr,
rw_addr:= rw_addr,
other_actions:= oact

#)

End Linear_Memory_Blessing
% >> MV:
% − todo: establishis_linear_plain_memory ? from a single state and
% concludethat applyingthe state transformersyieldsnew
% states for whichis_linear_plain_memory ? holds.
Linear_Memory_Properties [Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory] : Theory

Begin

Importing Linear_Memory_Blessing [Physical_memory, pm_phy],

Plain_Mem_Rewrites

,

Even_More_List_Props

s : Var Linear_memory
lvl : Var Level
pm : Var Plain_Memory[Linear_memory]
% Helpers
% =========
% rewritememory_read(pm‘mem...) = linear_read(...)
% proof status:−)
pm_read_linear: Lemma
Forall (a : Address) :
is_linear_plain_memory ?(pm) Implies
memory_read(pm‘mem)(a) = linear_read(a)
% proof status:−)
pm_write_linear: Lemma
Forall (a : Address, b : Byte) :
is_linear_plain_memory ?(pm) Implies

99 B PVS Theory Sources

memory_write(pm‘mem)(a, b) = linear_write(a, b)
% proof status:−)
pm_read_side_effect_linear : Lemma
Forall (a : Address, bl : list[Byte], cp : bool) :
is_linear_plain_memory ?(pm) Implies
memory_read_side_effect (pm‘mem)(a, bl, cp) =
linear_read_side_effect (a, bl, cp)
% proof status:−)
pm_write_side_effect_linear : Lemma
Forall (a : Address, bl : list[Byte], cp : bool) :
is_linear_plain_memory ?(pm) Implies
memory_write_side_effect (pm‘mem)(a, bl, cp) =
linear_write_side_effect (a, bl, cp)
% proof status:−)
pm_states: Lemma
is_linear_plain_memory ?(pm) Implies pm‘states = pm_phy‘states
% proof status:−)
pm_plain_phy: Lemma
is_linear_plain_memory ?(pm) Implies plain_memory?(pm_phy)
% proof status:−)
% pm_memory_addr_TCC1 : TCCObligation
% proof status:−)
% pm_memory_addr_TCC2 : TCCObligation
% proof status:−)
pm_memory_addr: Lemma
Forall (a : Address) :
is_linear_plain_memory ?(pm) And union(pm‘ro_addr, pm‘rw_addr)(a) Implies
in_memory(min_linear, max_linear)(a) And Mem?(type_of(a))
% proof status:−)
pm_linear_blessed: Lemma
is_linear_plain_memory ?(pm) And pm‘states(s) Implies
linear_blessed?(s, pm‘ro_addr, pm‘rw_addr)
% proof status:−)
% pm_linear_resolve_read_ok_TCC1 : TCCObligation
% proof status:−)
pm_linear_resolve_read_ok : Lemma
Forall (s : (pm‘states), a : (union(pm‘ro_addr, pm‘rw_addr))) :
is_linear_plain_memory ?(pm) Implies OK?(linear_resolve(a, Read)(s))
% proof status:−)
% pm_linear_resolve_write_ok_TCC1 : TCCObligation

100

B.4 challenge-linear.pvs

% proof status:−)
pm_linear_resolve_write_ok : Lemma
Forall (s : (pm‘states), a : (pm‘rw_addr)) :
is_linear_plain_memory ?(pm) Implies OK?(linear_resolve(a, Write)(s))
% proof status:−)
pm_linear_resolve_reg_transformers_other : Lemma
is_linear_plain_memory ?(pm)

Implies

subset?(linear_resolve_register_transformers , pm_phy‘other_actions)
% proof status:−)
pm_unchanged_singleton_linear_resolve_reg_transformers : Lemma
Forall (q : [Physical_memory−> SuperResult[Physical_memory]]) :
is_linear_plain_memory ?(pm) And linear_resolve_register_transformers (q)

Implies

unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states, singleton(q),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% proof status:−)
pm_address_in_pt_range_in_rw_addr : Lemma
is_linear_plain_memory ?(pm) And pm‘states(s) Implies
subset?(address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr)),
pm_phy‘rw_addr)
% proof status:−)
% address_block_in_memory_TCC1 : TCCObligation
% proof status:−)
address_block_in_memory : Lemma
Forall (a : Address, bl : list[Byte]) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr)) And
cons?(bl)

Implies

a + length(bl) <= reg_size(max_linear)(type_of(a))
% proof status:−)
address_block_in_memory2 : Lemma
Forall (a : Address, bl : list[Byte]) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr)) And
cons?(bl)

Implies

0 <= a‘offset
% proof status:−)
raise_fault_transformer_invariant : Lemma
Forall (priv : Memory_privilege, access : Memory_access, present : bool,
pfa : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) Implies
transformer_invariant?(pm_phy‘states, singleton(expr_2_super (

101 B PVS Theory Sources

raise_fault(priv, access, present, pfa))))
% proof status:−)
raise_fault_unchanged_memory_invariant : Lemma
Forall (priv : Memory_privilege, access : Memory_access, present : bool,
pfa : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) Implies
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (raise_fault(priv, access, present, pfa))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% Side Effects
% ==============
% proof status:−)
apply_side_effects_pm_states : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]]) :
is_linear_plain_memory ?(pm) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states, singleton(expr_2_super (f(e)))))(l)

Implies

transformer_invariant?(pm‘states, singleton(
expr_2_super (apply_side_effects (l, f))))
% proof status:−)
apply_side_effects_ok : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]]) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
(Forall (s1 : (pm‘states)) :
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(f(e)(s1)))(l)) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states,
singleton(expr_2_super (f(e)))))(l)

Implies

OK?(apply_side_effects (l, f)(s))
% proof status:−)
% apply_side_effects_same_result_TCC1 : TCCObligation
% proof status:−)
apply_side_effects_same_result : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]]) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
(Forall (s1 : (pm‘states)) :

102

B.4 challenge-linear.pvs

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(f(e)(s1)))(l)) And
(Forall (s1 : (pm‘states)) :
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(f(e)(s1)) Implies data(f(e)(s1)) = e‘2)(l)) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states, singleton(expr_2_super (f(e)))))(l)

Implies

data(apply_side_effects (l, f)(s)) =
reduce(null, Lambda (e : [Address, list[Byte]], tail : list[Byte]) :
Let head = e‘2 In append(head, tail))(l)
% proof status:−)
apply_side_effects_unchanged : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]],
addresses : PRED[Memory_Address_4G ]) :
is_linear_plain_memory ?(pm) And
subset?(addresses, union(pm_phy‘ro_addr, pm_phy‘rw_addr)) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (f(e))), addresses))(l)

Implies

unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (apply_side_effects (l, f))), addresses)
% MainResolveResults
% ======================
% proof status:−)
subset_ptab_address_rw_addr : Lemma
Forall (base : Memory_Address_4G ) :
subset?(address_in_pt_range ?(s,
union(restrict[Address, Memory_Address_4G , bool](pm‘ro_addr),
restrict[Address, Memory_Address_4G , bool](pm‘rw_addr))),
restrict[Address, Memory_Address_4G , bool](pm_phy‘rw_addr)) And
subset?(address_block(base, expt(2, pe_size)),
extend[Address, Memory_Address_4G , bool, FALSE]
(address_in_pt_range ?(s,
restrict[Address, Memory_Address_4G , bool]
(union(pm‘ro_addr, pm‘rw_addr)))))

Implies

subset?(address_block(base, expt(2, pe_size)), pm_phy‘rw_addr)

% proof status:−)
translate_transformer_invariant: Lemma
Forall (base : PTab_Address, lin_a: Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And

103 B PVS Theory Sources

subset?(address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)),
pm_phy‘rw_addr)

Implies

transformer_invariant?(pm‘states, singleton(expr_2_super (
translate(lvl, base, lin_a, access, priv))))
% proof status:−)
% translate_unchanged_pm_phy_except_pe_TCC1 : TCCObligation
% proof status:−)
% translate_unchanged_pm_phy_except_pe_TCC2 : TCCObligation
% proof status:−)
translate_unchanged_pm_phy_except_pe : Lemma
Forall (base : PTab_Address, lin_a: Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
subset?(address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)),
pm_phy‘rw_addr) And
(Forall (s : (pm‘states)) :
OK?(read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s))) And
(Forall (s1, s2 : (pm‘states)) :
set_reference(data(read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s1)), Write) =
set_reference(data(read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s2)), Write))

Implies

Let pe_addr= xlat_idx(lvl, base, lin_a) In
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (translate(lvl, base, lin_a, access, priv))),
difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_block(pe_addr, expt(2, pe_size))))
% proof status:−)
% translate_result_ok_TCC1 : TCCObligation
% proof status:−)
translate_result_ok: Lemma
Forall (s1, s2 : (pm‘states), base : PTab_Address,
lin_a: Memory_Address_4G , access : Memory_access,
priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
pe_in_pt_range ?(s1, union(pm‘ro_addr, pm‘rw_addr), lvl)
(xlat_idx(lvl, base, lin_a)) And
OK?(translate(lvl, base, lin_a, access, priv)(s1))

Implies

OK?(translate(lvl, base, lin_a, access, priv)(s2))
% proof status:−)

104

B.4 challenge-linear.pvs

% translate_result_as_read_TCC1 : TCCObligation
% proof status:−)
% translate_result_as_read_TCC2 : TCCObligation
% proof status:−)
translate_result_as_read : Lemma
Forall (base : PTab_Address, lin_a: Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
OK?(translate(lvl, base, lin_a, access, priv)(s))

Implies

Let res = read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s) In
data(translate(lvl, base, lin_a, access, priv)(s)) =
(is_leaf?(data(res)), base(data(res)))
% proof status:−)
translate_same_result: Lemma
Forall (s1, s2 : (pm‘states), base : PTab_Address,
lin_a: Memory_Address_4G , ac1, ac2 : Memory_access,
priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
pe_in_pt_range ?(s1, union(pm‘ro_addr, pm‘rw_addr), lvl)
(xlat_idx(lvl, base, lin_a)) And
OK?(translate(lvl, base, lin_a, ac1, priv)(s1)) And
OK?(translate(lvl, base, lin_a, ac2, priv)(s2))

Implies

data(translate(lvl, base, lin_a, ac1, priv)(s1)) =
data(translate(lvl, base, lin_a, ac2, priv)(s2))
% proof status:−)
% xlat_pe_in_pdir_range_TCC1 : TCCObligation
% proof status:−)
% xlat_pe_in_pdir_range_TCC2 : TCCObligation
% proof status:−)
% xlat_pe_in_pdir_range_TCC3 : TCCObligation
% proof status:−)
xlat_pe_in_pdir_range : Lemma
Forall (addr : Memory_Address_4G , s1, s2 : Linear_memory) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s1) And pm‘states(s2)

Implies

pe_in_pdir_range ?(s1, union(pm‘ro_addr, pm‘rw_addr))
(xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s2))‘base_addr, addr))

105 B PVS Theory Sources

% proof status:−)
% xlat_pe_in_pt_range_TCC1 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC2 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC3 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC4 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC5 : TCCObligation
% proof status:−)
xlat_pe_in_pt_range : Lemma
Forall (addr : Memory_Address_4G , access : Memory_access,
priv : Memory_privilege, s1, s2 : Linear_memory) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s1) And pm‘states(s2) And
OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s1))‘base_addr, addr, access, priv)
(state(read_data(pm_phy, pdbr_data_type )(PDBR)(s1)))) And
Not data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s1))‘base_addr, addr, access, priv)
(state(read_data(pm_phy, pdbr_data_type )(PDBR)(s1))))‘1

Implies

pe_in_pt_range ?(s2, union(pm‘ro_addr, pm‘rw_addr), ptab_lvl)
(xlat_idx(ptab_lvl, data(translate(pdir_lvl,
data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s1))‘base_addr, addr, access, priv)
(state(read_data(pm_phy, pdbr_data_type )(PDBR)(s1))))‘2, addr))
% proof status:−)
linear_resolve_unchanged_pm_phy : Lemma
Forall (addr : Memory_Address_4G , access : Memory_access) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s)

Implies

unchanged_memory_invariant ?[Physical_memory](pm_phy‘mem, pm‘states,
singleton(expr_2_super [Physical_memory, Address](
linear_resolve(addr, access))),
difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr))))
% proof status:−)
linear_resolve_read_transformers_ok : Lemma
Forall (addr : Memory_Address_4G ) :

106

B.4 challenge-linear.pvs

is_linear_plain_memory ?(pm) And
union(pm‘ro_addr, pm‘rw_addr)(addr)

Implies

transformers_ok?(pm‘states, singleton(expr_2_super (
linear_resolve(addr, Read))))
% proof status:−)
linear_resolve_write_transformers_ok : Lemma
Forall (addr : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) And
pm‘rw_addr(addr)

Implies

transformers_ok?(pm‘states, singleton(expr_2_super (
linear_resolve(addr, Write))))
% proof status:−)
linear_resolve_transformer_invariant : Lemma
Forall (addr : Memory_Address_4G , access : Memory_access) :
is_linear_plain_memory ?(pm) And
union(pm‘ro_addr, pm‘rw_addr)(addr)

Implies

transformer_invariant?(pm‘states, singleton(expr_2_super (
linear_resolve(addr, access))))
% proof status:−)
% linear_resolve_states_TCC1 : TCCObligation
% proof status:−)
linear_resolve_states: Lemma
Forall (addr : Memory_Address_4G , access : Memory_access) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s) And
OK?(linear_resolve(addr, access)(s))

Implies

pm_phy‘states(state(linear_resolve(addr, access)(s)))
% proof status:−)
linear_resolve_same_result : Lemma
Forall (addr : Memory_Address_4G , ac1, ac2 : Memory_access,
s1, s2 : Linear_memory) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s1) And pm‘states(s2) And
OK?(linear_resolve(addr, ac1)(s1)) And
OK?(linear_resolve(addr, ac2)(s2))

Implies

data(linear_resolve(addr, ac1)(s1)) =
data(linear_resolve(addr, ac2)(s2))
% Translationof addresseswithinsame page
% ===========================================

107 B PVS Theory Sources

% proof status:−)
delta_memory_address: Lemma
Forall (addr : Memory_Address_4G , delta : nat) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page)

Implies

offset(addr + delta) < max_linear_offset
% proof status:−)
% xlat_idx_same_page_address_TCC1 : TCCObligation
% proof status:−)
% xlat_idx_same_page_address_TCC2 : TCCObligation
% proof status:−)
xlat_idx_same_page_address : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,
base : {a : Memory_Address_4G|
aligned?(bits_per_level+ pe_size)(offset(a))}) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page)

Implies

xlat_idx(lvl, base, addr) = xlat_idx(lvl, base, addr + delta)
% proof status:−)
% xlat_ofs_same_page_address_TCC1 : TCCObligation
% proof status:−)
% xlat_ofs_same_page_address_TCC2 : TCCObligation
% proof status:−)
xlat_ofs_same_page_address : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,
base : {a : Memory_Address_4G| aligned?(bus_width− (lvl + 1) ∗
bits_per_level )(offset(a))}) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page)

Implies

xlat_ofs(lvl, base, addr) + delta = xlat_ofs(lvl, base, addr + delta)
% proof status:−)
translate_same_page_address_ok : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,
base : {a : Memory_Address_4G|
aligned?(bits_per_level+ pe_size)(offset(a))},
access : Memory_access, priv : Memory_privilege) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

OK?(translate(lvl, base, addr + delta, access, priv)(s))
% proof status:−)
translate_same_page_address_result : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,

108

B.4 challenge-linear.pvs

base : {a : Memory_Address_4G|
aligned?(bits_per_level+ pe_size)(offset(a))},
access : Memory_access, priv : Memory_privilege) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

translate(lvl, base, addr, access, priv)(s) =
translate(lvl, base, addr + delta, access, priv)(s)
% proof status:−)
% linear_resolve_same_page_address_ok_TCC1 : TCCObligation
% proof status:−)
linear_resolve_same_page_address_ok : Lemma
Forall (addr : Memory_Address_4G , delta : nat, ac : Memory_access) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(linear_resolve(addr, ac)(s))

Implies

OK?(linear_resolve(addr + delta, ac)(s))
% proof status:−)
% linear_resolve_same_page_address_TCC1 : TCCObligation
% proof status:−)
linear_resolve_same_page_address : Lemma
Forall (addr : Memory_Address_4G , delta : nat, ac : Memory_access) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(linear_resolve(addr, ac)(s))

Implies

data(linear_resolve(addr, ac)(s)) + delta =
data(linear_resolve(addr + delta, ac)(s))
% LinearMemorySide Effects
% ============================
% proof status:−)
address_block_split_type : Lemma
Forall (a : Memory_Address_4G , bl : list[Byte]) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr))

Implies

every(LAMBDA (t: [Address, list[Byte]]): Mem?(t‘1‘type_of) AND
0 <= t‘1‘offset And
t‘1‘offset < max_linear_offset )
(split(min_page, a, bl))

% proof status:−)
% same_page_address_block_read_TCC1 : TCCObligation
% proof status:−)
same_page_address_block_read : Lemma

109 B PVS Theory Sources

Forall (a1, a2 : Memory_Address_4G , s1, s2 : posnat) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(a2) And
a1 <= a2 And a2 + s2 <= a1 + s1 And
rem(expt(2, min_page))(offset(a2)) + s2 <= expt(2, min_page) And
subset?(address_block(a1, s1), union(pm‘ro_addr, pm‘rw_addr))

Implies

subset?(address_block(data(linear_resolve(a2, Read)(s)), s2),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% proof status:−)
% same_page_address_block_write_TCC1 : TCCObligation
% proof status:−)
same_page_address_block_write : Lemma
Forall (a1, a2 : Memory_Address_4G , s1, s2 : posnat) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
pm‘rw_addr(a2) And
a1 <= a2 And a2 + s2 <= a1 + s1 And
rem(expt(2, min_page))(offset(a2)) + s2 <= expt(2, min_page) And
subset?(address_block(a1, s1), pm‘rw_addr)

Implies

subset?(address_block(data(linear_resolve(a2, Write)(s)), s2),
pm_phy‘rw_addr)
% proof status:−)
% split_linear_read_side_effects_states_TCC1 : TCCObligation
% proof status:−)
split_linear_read_side_effects_states : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr))

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states,
singleton(expr_2_super (linear_read_side_effect_in_page (e)))))
(split(min_page, a, bl))
% proof status:−)
% split_linear_write_side_effects_states_TCC1 : TCCObligation
% proof status:−)
split_linear_write_side_effects_states : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states,

110

B.4 challenge-linear.pvs

singleton(expr_2_super (linear_write_side_effect_in_page (e)))))
(split(min_page, a, bl))
% proof status:−)
split_linear_read_side_effects_ok : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)),
union(pm‘ro_addr, pm‘rw_addr)) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_read_side_effect_in_page (e)(s)))
(split(min_page, a, bl))
% proof status:−)
split_linear_write_side_effects_ok : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_write_side_effect_in_page (e)(s)))
(split(min_page, a, bl))
% proof status:−)
split_linear_read_side_effects_data : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)),
union(pm‘ro_addr, pm‘rw_addr)) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_read_side_effect_in_page (e)(s)) Implies
data(linear_read_side_effect_in_page (e)(s)) = e‘2)
(split(min_page, a, bl))
% proof status:−)
split_linear_write_side_effects_data : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_write_side_effect_in_page (e)(s)) Implies
data(linear_write_side_effect_in_page (e)(s)) = e‘2)
(split(min_page, a, bl))
% proof status:−)

111 B PVS Theory Sources

split_linear_read_side_effects_unchanged_memory : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr))

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
unchanged_memory_invariant ?(pm_phy‘mem, pm‘states,
singleton(expr_2_super (linear_read_side_effect_in_page (e))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr)))
(split(min_page, a, bl))
% proof status:−)
split_linear_write_side_effects_unchanged_memory : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
unchanged_memory_invariant ?(pm_phy‘mem, pm‘states,
singleton(expr_2_super (linear_write_side_effect_in_page (e))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr)))
(split(min_page, a, bl))

% linear_unchanged_invariant
% ============================
% proof status:−)
linear_unchanged_invariant: Lemma
Forall (transformers : PRED[[Linear_memory−> SuperResult[Linear_memory]]],
addresses : PRED[Memory_Address_4G ]) :
is_linear_plain_memory ?(pm) And
subset?(addresses, union(pm‘ro_addr, pm‘rw_addr)) And
(Forall (s : (pm‘states)) :
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
transformers,
virt_to_phys_range (s, addresses, union(singleton(Read),
singleton(Execute)))))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states, transformers, addresses)

% simplehelpersfor unchangedlemmas
% =====================================
% proof status:−)
% pm_phy_read_after_resolve_ok_TCC1 : TCCObligation
% proof status:−)
pm_phy_read_after_resolve_ok : Lemma

112

B.4 challenge-linear.pvs

Forall (a1 : Address, a2 : Memory_Address_4G , ac : Memory_access) :
OK?(linear_resolve(a2, ac)(s)) And
plain_memory?(pm_phy) And
pm_phy‘states(state(linear_resolve(a2, ac)(s))) And
union(pm_phy‘ro_addr, pm_phy‘rw_addr)(a1)

Implies

OK?(memory_read(pm_phy‘mem)(a1)(state(linear_resolve(a2, ac)(s))))
% proof status:−)
pm_resolve_address: Lemma
Forall (a : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
virt_to_phys_range (s, union(pm‘ro_addr, pm‘rw_addr),
union(singleton(Read), singleton(Execute)))(a)

Implies

difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr)))(a)
% proof status:−)
pm_resolve_address_write : Lemma
Forall (a : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
virt_to_phys_range (s, pm‘rw_addr, singleton(Write))(a)

Implies

difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr)))(a)

End Linear_Memory_Properties

Linear_Memory_Blessing_Properties

[% the underlyingphysicalmemory
Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory
] : Theory

Begin

Importing Linear_Memory_Properties [Physical_memory, pm_phy]
pm : Var Plain_Memory[Linear_memory]
% Blessingresults
% ==================
% proof status:−)
linear_plain_transformers_ok : Lemma
is_linear_plain_memory ?(pm)

Implies

113 B PVS Theory Sources

transformers_ok?(pm‘states, union(union(
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr)), union(
memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))
% proof status:−)
linear_plain_unchanged_memory_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
union(union(pm‘other_actions,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
linear_plain_unchanged_memory_invariant_write : Lemma
is_linear_plain_memory ?(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr), pm‘ro_addr)

% proof status:−)
linear_plain_unchanged_memory_write_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

unchanged_memory_write_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
linear_plain_transformer_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

transformer_invariant?(pm‘states, union(union(pm‘other_actions,
union(memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))
% proof status:−)
linear_plain_changed_memory_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

changed_memory_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% We must use expressiontransformersinsteadof supertransformers
% to match the list argumentof the side effect transformerin

114

B.5 challenge-phymem.pvs

% side_effect_content_unchangedagainstthe transformerobtained
% from the unionof memoryside effect transformers. Super
% transformersgive us onlyequalityon resultstates.
% proof status:−)
linear_plain_read_side_effect_unchanged : Lemma
is_linear_plain_memory ?(pm)

Implies

side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
memory_read_side_effect (pm‘mem))
% proof status:−)
linear_plain_write_side_effect_unchanged : Lemma
is_linear_plain_memory ?(pm)

Implies

side_effect_content_unchanged (pm‘rw_addr, pm‘states,
memory_write_side_effect (pm‘mem))
% %%%% FinalBlessingResult%%%%%
% proof status:−)
linear_memory_plain_memory : Lemma
is_linear_plain_memory ?(pm)
Implies plain_memory?(pm)
End Linear_Memory_Blessing_Properties

B.5 challenge-phymem.pvs

Phy_Mem_Properties [(IMPORTING IA32) min, max : Memory_Address] : Theory
% Propertiesof physicalmemory

Begin

IMPORTING Memory_Physical_Memory [min, max], Memory_Change_2
IMPORTING Physical_Memory_Properties [min, max]
addr : Var Address
s : Var Physical_memory
% proof status:−)
phy_mem_write_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_write_transformers (phy_mem, in_memory(min, max)))
% proof status:−)
phy_mem_read_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_read_transformers (phy_mem, in_memory(min, max)))
% proof status:−)
phy_mem_read_side_effects_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)))

115 B PVS Theory Sources

% proof status:−)
phy_mem_write_side_effects_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))
% proof status:−)
phy_mem_unchanged_memory_invariant_read_transformers : Lemma
unchanged_memory_invariant ?(phy_mem, fullset[Physical_memory],
memory_read_transformers (phy_mem, in_memory(min, max)),
in_memory(min, max))
% proof status:−)
phy_mem_unchanged_memory_invariant_read_side_effect_transformers : Lemma
unchanged_memory_invariant ?(phy_mem, fullset[Physical_memory],
memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)),
in_memory(min, max))
% proof status:−)
phy_mem_unchanged_memory_invariant_write_side_effect_transformers : Lemma
unchanged_memory_invariant ?(phy_mem, fullset[Physical_memory],
memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)),
in_memory(min, max))
% proof status:−)
phy_mem_unchanged_memory_write_invariant : Lemma
unchanged_memory_write_invariant ?(phy_mem, fullset[Physical_memory],
in_memory(min, max))
% proof status:−)
phy_mem_changed_memory_invariant : Lemma
changed_memory_invariant ?(phy_mem, fullset[Physical_memory],
in_memory(min, max))
End Phy_Mem_Properties

Phy_Mem_Blessing [(IMPORTING IA32) min, max : Memory_Address] : Theory
% all physicalmemoryis blessedmemory

Begin

Importing Phy_Mem_Properties [min, max], Plain_Memory
oact : Var PRED[[Physical_memory−>SuperResult[Physical_memory]]]
phy_pm(oact) : Plain_Memory[Physical_memory] = (#
mem := phy_mem,
states := fullset[Physical_memory],
ro_addr:= emptyset[Address],
rw_addr:= in_memory(min, max),
other_actions:= oact

#)

116

B.5 challenge-phymem.pvs

% proof status:−)
phy_mem_plain_memory : Lemma
unchanged_memory_invariant ?(phy_mem,
fullset[Physical_memory], oact, in_memory(min, max))

Implies

plain_memory?(phy_pm(oact))
End Phy_Mem_Blessing

Phy_Mem_Blessing_Data [Data : Type, (IMPORTING IA32) min, max : Memory_Address] : Theory

Begin

Importing Phy_Mem_Blessing [min, max], Abstract_Read_Write
addr : Var Address
idt : Var (interpreted_data_type ?[Data])
% proof status:−)
in_memory_blessed_memory : Lemma
in_memory?(idt, addr, min, max) Implies
in_blessed_memory ?(idt, addr, in_memory(min, max))
End Phy_Mem_Blessing_Data

Phy_Mem_Challenge_Read_Same

[Data : Type, (IMPORTING IA32) min, max : Memory_Address] : Theory

%

% read after writeat the same place returnsthe item written

Begin

IMPORTING Phy_Mem_Blessing [min, max],
Plain_Mem_Properties_2 [Physical_memory, Data],
Phy_Mem_Blessing_Data [Data, min, max]
dt : Var (interpreted_data_type ?[Data])
s : Var Physical_memory
addr : Var Address
data : Var Data

% proof status:−)
read_write_ok: Lemma in_memory?(dt, addr, min, max)

IMPLIES

OK?((
write_data(phy_mem,dt)(addr, data) ##
read_data(phy_mem,dt)(addr)
)(s)

)

% proof status:−)

117 B PVS Theory Sources

% read_write_res_TCC1 : TCCObligation
% proof status:−)
read_write_res: Lemma in_memory?(dt, addr, min, max)

IMPLIES

data((
write_data(phy_mem,dt)(addr, data) ##
read_data(phy_mem,dt)(addr)
)(s))
= data
end Phy_Mem_Challenge_Read_Same

Phy_Mem_Challenge_Read_Other

[(IMPORTING IA32) min, max : Memory_Address, Data1, Data2 : Type] : Theory
% Phy_Mem_Challenge_Read_Other : Theory

%

% for read after writeat a differentplace you can discardthe write

% Begin

IMPORTING Phy_Mem_Blessing [min, max],
Plain_Mem_Properties_3 [Physical_memory, Data1, Data2],

Phy_Mem_Blessing_Data

dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
s : Var Physical_memory
addr1, addr2 : Var Address
data1 : Var Data1
% proof status:−)
read_write_other_ok : Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) AND
valid_in_mem (phy_mem,dt2)(addr2)(s)

IMPLIES

OK?

((

write_data(phy_mem,dt1)(addr1, data1) ##
read_data(phy_mem,dt2)(addr2)
)(s)

)

% proof status:−)
% read_write_other_res_TCC1 : TCCObligation
% proof status:−)
% read_write_other_res_TCC2 : TCCObligation
% proof status:−)

118

B.6 challenge-ptab-sync-master.pvs

read_write_other_res : Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) AND
valid_in_mem (phy_mem,dt2)(addr2)(s)

IMPLIES

data((
write_data(phy_mem,dt1)(addr1, data1) ##
read_data(phy_mem,dt2)(addr2)
)(s))

=

data(read_data(phy_mem,dt2)(addr2)(s))

% proof status:−)
read_read_ok: Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
valid_in_mem (phy_mem,dt1)(addr1)(s) And
valid_in_mem (phy_mem,dt2)(addr2)(s)

Implies

OK?(
( read_data(phy_mem, dt1)(addr1) ##
read_data(phy_mem, dt2)(addr2)
)(s)

)

% proof status:−)
% read_read_TCC1: TCCObligation
% proof status:−)
% read_read_TCC2: TCCObligation
% proof status:−)
read_read: Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
valid_in_mem (phy_mem,dt1)(addr1)(s) And
valid_in_mem (phy_mem,dt2)(addr2)(s)

Implies

data (
( read_data(phy_mem, dt1)(addr1) ##
read_data(phy_mem, dt2)(addr2)
)(s)

)

= data(read_data(phy_mem, dt2)(addr2)(s))
End Phy_Mem_Challenge_Read_Other

B.6 challenge-ptab-sync-master.pvs

119 B PVS Theory Sources

Challenge_Ptab_Sync_Master : Theory

Begin

Importing ptab_sync_master
% to do: specificationand proofs
End Challenge_Ptab_Sync_Master

B.7 constants.pvs

% generalconstantsand types
% (includingarchitecturedependentones)
General : Theory
% architectureindependentconstantsand types

Begin

Importing Number_Props
bits_per_byte: posnat
min_bits_per_byte : nat = 8
bits_per_byte_minimum : Axiom bits_per_byte>= min_bits_per_byte
max_byte: nat = expt(2, bits_per_byte )
% proof status:−)
% Byte_TCC1: TCCObligation
Byte : Nonempty_Type = below(max_byte) containing 0
% proof status:−)
less_than_max_byte : Lemma Forall(n : nat) :
n < expt(2, 8) Implies n < max_byte
End General

Register_Id: Datatype

Begin

Mem_: Mem?
EAX_: EAX?
EBX_: EBX?
ECX_: ECX?
EDX_: EDX?
ESI_: ESI?
EDI_: EDI?
ESP_: ESP?
EBP_: EBP?

120

B.7 constants.pvs

CS_: CS?
DS_: DS?
ES_: ES?
FS_: FS?
GS_: GS?
SS_: SS?
IP_: IP?
EFLAGS_: EFLAGS?
CR0_: CR0?
CR2_: CR2?
PDBR_: PDBR?
CR4_: CR4?
IDTR_: IDTR?
GDTR_: GDTR?
LDTR_: LDTR?
TR_: TR?
SYSENTER_CS_: SYSENTER_CS?
SYSENTER_ESP_: SYSENTER_ESP?
SYSENTER_EIP_: SYSENTER_EIP?
End Register_Id

Address_Helpers: Theory

Begin

Importing General, Register_Id
Address : Type = [# type_of: Register_Id, offset : int #]
% AddressConstructors
Mem(offset : int) : Address = (# type_of:= Mem_, offset := offset #)
CR0 : Address = (# type_of:= CR0_, offset := 0 #)
CR2 : Address = (# type_of:= CR2_, offset := 0 #)
CR4 : Address = (# type_of:= CR4_, offset := 0 #)
PDBR : Address = (# type_of:= PDBR_, offset := 0 #)
CS : Address = (# type_of:= CS_, offset := 0 #)
DS : Address = (# type_of:= DS_, offset := 0 #)
ES : Address = (# type_of:= ES_, offset := 0 #)
FS : Address = (# type_of:= FS_, offset := 0 #)
GS : Address = (# type_of:= GS_, offset := 0 #)
SS : Address = (# type_of:= SS_, offset := 0 #)
Segment_Register_Address: Type =
{a : Address | a = CS Or a = DS Or a = ES Or a = FS Or a = GS Or a = SS}

121 B PVS Theory Sources

Memory_Address: Type = {a : Address | Mem?(a‘type_of)}
a : Var Address
size : Var int
+(a, size) : Address = a With [(offset) := a‘offset + size]
m_addr: Var Memory_Address
% proof status:−)
type_add_rewrite: Lemma
(m_addr+ size)‘type_of= m_addr‘type_of
% proof status:−)
offset_add_rewrite: Lemma
(m_addr+ size)‘offset = m_addr‘offset + size
% proof status:−)
type_add_memory: Judgement +(m_addr, size) Has_TypeMemory_Address
% proof status:−)
address_add_zero: Lemma
Forall (a : Address) : a + 0 = a
% proof status:−)
address_add_sum: Lemma
Forall (a : Address, i, j : int) : (a + i) + j = a + (i + j)
a1, a2 : Var Address
< (a1, a2) : bool = a1‘type_of= a2‘type_ofAnd a1‘offset < a2‘offset;
<= (a1, a2) : bool = a1‘type_of= a2‘type_ofAnd a1‘offset <= a2‘offset
% Some registergroups
GP?(id: Register_Id) : bool =
EAX?(id) Or EBX?(id) Or ECX?(id) Or EDX?(id) Or ESI?(id) Or
EDI?(id) Or EBP?(id) Or ESP?(id)
Segment_Reg?(id : Register_Id) : bool =
CS?(id) Or DS?(id) Or ES?(id) Or FS?(id) Or GS?(id) Or SS?(id)
Control_Reg?(id : Register_Id) : bool =
CR0?(id) Or CR2?(id) Or CR4?(id) Or PDBR?(id)
Table_Reg?(id : Register_Id) : bool =
IDTR?(id) Or GDTR?(id) Or LDTR?(id) Or TR?(id)
MSR?(id : Register_Id) : bool =
SYSENTER_CS?(id) Or SYSENTER_ESP?(id) Or SYSENTER_EIP?(id)

122

B.7 constants.pvs

% Registersizes
% proof status:−)
% reg_size_TCC1: TCCObligation
% proof status:−)
% reg_size_TCC2: TCCObligation
reg_size(max : Memory_Address)(id : Register_Id) : Address =
Cases id Of
Mem_: (# type_of:= id, offset := offset(max) #),
IP_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
EFLAGS_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
IDTR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 8) #),
GDTR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 8) #),
LDTR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 14) #),
TR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 14) #),
SYSENTER_CS_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
SYSENTER_ESP_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
SYSENTER_EIP_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #)

Else

Cond

GP?(id) −> (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
Segment_Reg?(id) −> (# type_of:= id, offset := expt(2, bits_per_byte∗ 14) #),
Control_Reg?(id) −> (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #)

EndCond EndCases

reg_base(min : Memory_Address)(id : Register_Id) : Address =
If Mem?(id) Then

min Else

(# type_of:= id, offset := 0 #)

Endif

in_memory(min, max : Memory_Address)(a : Address) : bool =
reg_base(min)(a‘type_of) <= a And a < reg_size(max)(a‘type_of)
floor(b : posnat)(a : Address) : Address =
a With [(offset) := floor(b)(offset(a))]
End Address_Helpers

IA32 : Theory
% architecturedependentconstantsand types

Begin

IMPORTING Address_Helpers

123 B PVS Theory Sources

% typeof addressesas subtypeof naturalnumbers
bus_width: nat = 32
max_linear_offset: nat = expt(2, bus_width)
max_linear: Address = Mem(max_linear_offset )
min_linear: Address = Mem(0)
% proof status:−)
max_linear_offset_val : Lemma max_linear_offset= 4294967296
% max_linear_expt_val : Lemmaoffset(max_linear) = expt(2, 32)

% memoryaddressesbelow 2^32, for those who need it
Memory_Address_4G: Type = {a : Memory_Address| 0 <= a‘offset And a‘offset < max_linear_offset }
% proof status:−)
% mem_addr_4g_TCC1: TCCObligation
mem_addr_4g (R : PRED[(in_memory(min_linear, max_linear))])(a : Memory_Address_4G ) : bool = R(a)
% smallestpage size
min_page: posnat = 12
AUTO_REWRITE− bus_width, max_linear, max_linear_offset_val
End IA32

B.8 conversions.pvs

% $Id: conversions.pvs,v 1.11.4.2.2.1.2.3 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

%

% A shallowembeddingof (some) C++ conversionsas state transformers.
% Section numbersin commentsthroughoutthis file refer to
% "Programminglanguages− C++", ISO/IEC14882:1998(E)
% Deviationsfrom the C++ standard:

%

% Thisis preliminarywork. Most of the standardhasn’t even been considered
% yet.
% A note on PVS conversions: PVS has conversionsas well. Shouldwe declare
% the C++ conversionfunctionsas PVS conversions, so that theyare applied
% automatically, based on typeinformation? We have decidedagainstdoing so
% for the followingreasons. 1) Explicitconversionsmake the PVS translation
% of C++ code less readable, but the translatedcode is of littleinterest.
% Whatreallymattersis the proof state, whichnecessarilycontainsthe

124

B.8 conversions.pvs

% conversionsanyway. 2) Explicitconversionsgive us more control. It is not
% quite clear (to me, anyway) how the PVS typechecker decides which
% conversionsmust be applied, and in whichorder. 3) Some C++ conversions
% requireadditionalinformation(e.g. the lvalue−to−rvalueconversionmust
% know the typeof the stored value), and must thereforebe made explicit
% anyway.
% Namingconvention: conversionsbetweendifferenttypesare named
% < source>2< dest>
% where < source> and < dest> are the source and destinationtype, respectively, as
% givenin types.pvs. Examples: bool2int, int2uint.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.1: Lvalueto rvalueconversion

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
LvalueToRvalueConversion[State, Data : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain
pm : VAR Plain_Memory[State]
dt : VAR (interpreted_data_type ?[Data])
s : VAR State
a_ex: VAR [State −> ExprResult[State, Address]]
% MV>> do we need l2r for non−fundamentaltypes??
% 4.1.2: l2r(class) returnsan rvalueto a copy initialisedtemporary
l2r(pm, dt)(a_ex) : [State −> ExprResult[State, Data]] =

(

a_ex## lambda (a : Address):
read_data(pm, dt)(a) ## lambda (d : Data):
ok_result(d)

)

% MV>>
% l2r_class(pm, copy_constructor)(a_ex) : ET[State, Data]
% with_new_stackvar ()(lambda(temporary: Address) :
% copy_constructor(temporary, a_ex)
% XXX
% MV>>
% It seems like we could restrictData in ET[.., Data] to fundamentaltypes;
% Forclasses it seems the standardrequiresan in place creationor temporariesand the
% onlythingto do witha class is to access a member.
END LvalueToRvalueConversion

125 B PVS Theory Sources

% MV:>> make promotionsand conversionspolymorphicover the fundamentaltypes

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.5: Integralpromotions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
IntegralPromotions[State : Type] : THEORY

BEGIN

IMPORTING Cpp_Types, Ok_Result_Rewrite
% 4.5(1)
% "An rvalueof typechar [...]can be convertedto an rvalueof typeint if
% int can representall the valuesof the source type; otherwise, the source
% rvaluecan be convertedto an rvalueof typeunsignedint."
% We take this to mean that in the formercase, the valueis not changed.
% TODO: I have no idea how to model this correctly, for the ∗type∗ of the
% conversionwoulddependon the condition. Also, I’m not sure what
% shouldhappento source rvalueswhen int cannot representall the
% valuesof the source type, and unsignedint cannot representthe
% particularrvalue. Below, onlythe firstalternative(conversionto
% int) is modeled. However, 4.7(3) specifiesthe behaviorof conversions
% to int when those conversionsare ∗not∗ availableas integral
% promotions. To sum up, we can ∗always∗ convertto int; the behavioris
% specifiedeitherby 4.5 or by 4.7. Likewise, we can alwaysconvertto
% unsignedint; this is modeledin theoryIntegralConversionsbelow.
% char2int
% schar2int
% uchar2int
% short2int
% ushort2int
typ : Var Cpp_Subtype(cv({t : Cpp_Type| char?(t) Or schar?(t) Or uchar?(t) Or
short?(t) Or ushort?(t)}))
% proof status:−)
% int_conversion_TCC1: TCCObligation
% proof status:−)
% int_conversion_TCC2: TCCObligation
% proof status:−)
% int_conversion_TCC3: TCCObligation
int_conversion(typ) : [(range(typ)) −> (range(int))]

126

B.8 conversions.pvs

% proof status:−)
% int_conversion_spec_TCC1 : TCCObligation
int_conversion_spec: AXIOM
forall (n : (range(typ))) :
% 4.5(1) / 4.7(3)
range(int)(n) Implies int_conversion(typ)(n) = n
% 4.7(3): otherwiseconversionis allowed, but the valueis
% implementation−defined
int_conversion(typ)(n_ex: ET[State, (range(typ))]) : ET[State, (range(int))] =

(

n_ex## lambda (n : (range(typ))) :
ok_result(int_conversion(typ)(n))

)

i_typ: Var Cpp_Subtype(cv(non_bool_integral_enum ?))
% range to PVS int
range_to_int (i_typ)(n_ex: ET[State, (range(i_typ))]) : ET[State, int] =

(

n_ex## lambda (n : (range(i_typ))) :
ok_result(n)

)

% PVS int to range
int_to_range (i_typ)(n_ex: ET[State, int]) : ET[State, (range(i_typ))] =

(

n_ex## lambda (n : int) :
If range(i_typ)(n) Then
ok_result(n)

Else

fatal_result Endif

)

% 4.5(2): TODO(wchar_t, enumerationtypes)
% 4.5(3): TODO(bit−fields)
% 4.5(4)
bool_ex: VAR ET[State, bool]
% proof status:−)
% bool2int_TCC1: TCCObligation
% proof status:−)
% bool2int_TCC2: TCCObligation
bool2int(bool_ex) : ET[State, (range(int))] =

127 B PVS Theory Sources

(

bool_ex## lambda (b : bool) :
ok_result(if b then 1 else 0 endif)

)

END IntegralPromotions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.7: Integralconversions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
IntegralConversions[State : Type] : THEORY

BEGIN

IMPORTING Cpp_Types, Ok_Result_Rewrite
% 4.7(1): "An rvalueof an integertypecan be convertedto an rvalueof
% anotherintegertype."
% The integertypesare bool, char, wchar_t, (signed/unsigned) char,
% (signed/unsigned) short, (signed/unsigned) int, (signed/unsigned) long
% (3.9.1(7)).
% bool_ex: VAR[State −> ExprResult[State, Semantics_bool]]
% char_ex: VAR[State −> ExprResult[State, Semantics_char]]
% wchar_t_ex: VAR[State −> ExprResult[State, Semantics_wchar_t ]]
% schar_ex: VAR[State −> ExprResult[State, Semantics_schar]]
% uchar_ex: VAR[State −> ExprResult[State, Semantics_uchar]]
% short_ex: VAR[State −> ExprResult[State, Semantics_short]]
% ushort_ex: VAR[State −> ExprResult[State, Semantics_ushort]]
% int_ex: VAR[State −> ExprResult[State, Semantics_int]]
% uint_ex: VAR[State −> ExprResult[State, Semantics_uint]]
% long_ex: VAR[State −> ExprResult[State, Semantics_long]]
% ulong_ex: VAR[State −> ExprResult[State, Semantics_ulong]]
% %%%%%%%%%%
% Conversionsto bool: see 4.12
% %%%%%%%%%%
% %%%%%%%%%%
% Conversionsto char
% %%%%%%%%%%
% bool2char(bool_ex) : [State −> ExprResult[State, Semantics_char]]=
% (
% bool_ex## lambda(b : Semantics_bool):
% ok_result(if b then 1 else 0 endif)
% )

128

B.8 conversions.pvs

% TODO: wchar_t2char
% TODO: schar2char
% TODO: uchar2char
% TODO: short2char
% TODO: ushort2char
% TODO: int2char
% TODO: uint2char
% TODO: long2char
% TODO: ulong2char
% %%%%%%%%%%
% Conversionsto wchar_t
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto schar
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto uchar
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto short
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto ushort
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto int
% %%%%%%%%%%
% 4.7(5): "The conversionsallowedas integralpromotionsare excludedfrom the
% set of integralconversions."TheoryIntegralPromotionsshouldtherefore
% containmost of the necessarydefinitionsalready.
% TODO: long2int
% TODO: ulong2int
% %%%%%%%%%%

129 B PVS Theory Sources

% Conversionsto uint
% %%%%%%%%%%
% bool2uint(bool_ex) : [State −> ExprResult[State, Semantics_uint]]=
% (
% bool_ex## lambda(b : Semantics_bool):
% ok_result(if b then 1 else 0 endif)
% )
% TODO: wchar_t2uint
% TODO: schar2uint
% TODO: uchar2uint
% TODO: short2uint
% TODO: ushort2uint
% int2uint(int_ex) : [State −> ExprResult[State, Semantics_uint]]=
% (
% int_ex## lambda(i : Semantics_int):
% ok_result(mod(i, max_value(uint))) % 4.7(2)
% )
% TODO: long2uint
% TODO: ulong2uint
% %%%%%%%%%%
% Conversionsto long
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto ulong
% %%%%%%%%%%
% TODO
END IntegralConversions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.12: Booleanconversions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
BooleanConversions[State : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , Cpp_Types
s : VAR State

130

B.9 cpp-examples.pvs

% TODO: there shouldprobablybe separateconversionsfor everyarithmetic
% and pointertype
integral_to_bool (i_typ: Cpp_Subtype(cv(non_bool_integral_enum ?)))
(n_ex: ET[State, (range(i_typ))]) : ET[State, bool] =

(

n_ex## lambda (n : (range(i_typ))) :
ok_result(not (n = 0))

)

% To do: floating_point_to_bool
% proof status:−)
% pointer_to_bool_TCC1: TCCObligation
pointer_to_bool (p_typ: Cpp_Subtype(cv(pointer?)))
(p_ex: ET[State, (range_pointer(cv_base(p_typ)))]) : ET[State, bool] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(p_typ)))) :
ok_result(not_null?(p_typ)(ptr_val))

)

END BooleanConversions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% TODO: other conversions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Conversions: importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Conversions[State : Type] : THEORY

BEGIN

IMPORTING LvalueToRvalueConversion,
IntegralPromotions,
IntegralConversions,

BooleanConversions

END Conversions

B.9 cpp-examples.pvs

% $Id: cpp−examples.pvs,v 1.26.6.2.2.4.2.2 2008/05/14 14:24:58 tews Exp$

%

131 B PVS Theory Sources

% Author: TjarkWeber, MarcusVölp
% (c) 2007 RadboudUniversity

%

% Some (rathersimple) C++ programsand ((not yet) automatic) verification
% proofs.
Cpp_Examples[State : Type] : THEORY

BEGIN

IMPORTING Cpp_Verification[State]
STATES : PRED[State]
% skip
% proof status:−)
spec01 : LEMMA
Valid(STATES,
skip[State],
STATES)
pm : Plain_Memory[State]
a, b, c, n, m : Address
% proof status:−)
% PRECONDITION_TCC1 : TCCObligation
% proof status:−)
% PRECONDITION_TCC2 : TCCObligation
% proof status:−)
% PRECONDITION_TCC3 : TCCObligation
% proof status:−)
% PRECONDITION_TCC4 : TCCObligation
PRECONDITION : PRED[State] =
lambda (s : State):
pm‘states(s) and
in_blessed_memory ?(dt(int), n, pm‘rw_addr) and
in_blessed_memory ?(dt(int), m, pm‘rw_addr) and
in_blessed_memory ?(dt_bool, c, pm‘rw_addr) and
in_blessed_memory ?(dt(char), a, pm‘rw_addr) and
in_blessed_memory ?(dt(char), b, pm‘rw_addr) And
blocks_disjoint?(a, size_of(char), b, size_of(char)) And
blocks_disjoint?(b, size_of(char), a, size_of(char)) And
blocks_disjoint?(n, size_of(int), m, size_of(int)) And
blocks_disjoint?(m, size_of(int), n, size_of(int))
% proof status:−)
% POSTCONDITION_TCC1 : TCCObligation

132

B.9 cpp-examples.pvs

POSTCONDITION : PRED[State] =
lambda (s : State):
let ss = read_data(pm, dt(int))(n)(s) in
OK?(ss) and data(ss) = 42
% proof status:−)
% spec02_TCC1: TCCObligation
% a single assignment− partialcorrectness
% proof status:−)
spec02 : LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(n), literal(42))),
POSTCONDITION)
% a single assignment− total correctness
% proof status:−)
spec03 : LEMMA
plain_memory?(pm) implies
Valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(n), literal(42))),
POSTCONDITION)
% No disjointnessassumptionshouldbe necessaryfor this lemma.
% MV: Tjark: to removethe disjointnessassumptionwe need
% sizeof(char) = 1 and somethinglike:
% a /= b Andsizeof(dt) = 1 => block_disjoint(a, b) Andblock_disjoint(b, a)
% Do we reallyneed to check this automatically?
% proof status:−)
% spec04_TCC1: TCCObligation
% proof status:−)
% spec04_TCC2: TCCObligation
% two char assignments
% proof status:−)
spec04 : LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(char))(id(a), literal(42))) ##
e2s(assign(pm, dt(char))(id(b), literal(42))),
Lambda (s : State) : OK?(read_data(pm, dt(char))(a)(s)) And
data(read_data(pm, dt(char))(a)(s)) = 42)
% if−else
% proof status:−)
spec05: LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt_bool)(id(c), literal(true))) ##

133 B PVS Theory Sources

if_else(l2r(pm, dt_bool)(id(c)),
e2s(assign(pm, dt(int))(id(n), literal(42))),
skip),
POSTCONDITION)
% proof status:−)
% spec06_TCC1: TCCObligation
% proof status:−)
% spec06_TCC2: TCCObligation
% proof status:−)
% spec06_TCC3: TCCObligation
% proof status:−)
% spec06_TCC4: TCCObligation
% a switchstatement(withseveralassignments)
% proof status:−)
spec06 : LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(char))(id(a), literal(0))) ##
e2s(assign(pm, dt(char))(id(b), literal(1))) ##
switch(l2r(pm, dt(char))(id(a)), (: 0, 1 :),
case(0) ##
skip ##
case(1) ##
e2s(assign(pm, dt(int))(id(n), literal(42))) ##
break ##
default ##
e2s(assign(pm, dt(int))(id(n), literal(0)))

),

POSTCONDITION)

% a trivialinfiniteloop
% proof status:−)
spec07: LEMMA
valid(PRECONDITION,
while(literal(true),
skip),
lambda (s : State): false)

% a nontrivialloop
% proof status:−)
% N_TCC1: TCCObligation
N : {n : (range(int)) | n >= 0} = 2

134

B.9 cpp-examples.pvs

% proof status:−)
% range_int_values_TCC1 : TCCObligation
% proof status:−)
range_int_values: Lemma
Forall (i : int) :
−32767 <= i And i <= 32767

Implies

range(int)(i)
% proof status:−)
% spec08_TCC1: TCCObligation
% proof status:−)
spec08: LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(n), literal(0))) ##
e2s(assign(pm, dt(int))(id(m), literal(0))) ##
while(N + 1, lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),
e2s(postinc(pm, int)(id(n))) ##
e2s(postinc(pm, int)(id(m)))),
lambda (s : State) :
OK?(read_data(pm, dt(int))(m)(s)) Implies
data(read_data(pm, dt(int))(m)(s)) = N)
% proof status:−)
spec09 : Lemma
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(m), literal(0))) ##
for(
N + 1,
e2s(assign(pm, dt(int))(id(n), literal(0))),
lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),
postinc(pm, int)(id(n)),
e2s(postinc(pm, int)(id(m)))),
Lambda (s : State) :
OK?(read_data(pm, dt(int))(m)(s)) Implies
data(read_data(pm, dt(int))(m)(s)) = N)
% proof status:−)
% spec10_TCC1: TCCObligation
% >>
% proof status:−( unfinished
spec10 : Lemma
plain_memory?(pm) implies
valid(PRECONDITION,
for(
e2s(assign(pm, dt(int))(id(n), literal(0))),
lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),

135 B PVS Theory Sources

postinc(pm, int)(id(n)),
skip)(
% P
(Lambda (s0 : State) : Lambda (res : StmtResult[State]) :
OK?(res) And OK?(read_data(pm, dt(int))(n)(state(res))) And
0 <= data(read_data(pm, dt(int))(n)(state(res))) And
data(read_data(pm, dt(int))(n)(state(res))) < N

),

% Q
(Lambda (s0 : State) : Lambda (res : StmtResult[State]) :
OK?(res) And OK?(read_data(pm, dt(int))(n)(state(res))) And
data(read_data(pm, dt(int))(n)(state(res))) = N

),

% R
(Lambda (s0 : State) : Lambda (res : StmtResult[State]) :
OK?(res) And OK?(read_data(pm, dt(int))(n)(state(res))) And
data(read_data(pm, dt(int))(n)(state(res))) <= N

),

% variant
(Lambda (s0 : State) : Lambda (s : State) :
If OK?(read_data(pm, dt(int))(n)(s)) And
data(read_data(pm, dt(int))(n)(s)) <= N

Then

N − data(read_data(pm, dt(int))(n)(s))

Else N

Endif),
% order
Lambda (i, j : int) : i < j

),

Lambda (s : State) :
OK?(read_data(pm, dt(int))(n)(s)) Implies
data(read_data(pm, dt(int))(n)(s)) = N)
END Cpp_Examples
% Rewrite: Hoare rules
% (auto−rewrite"valid""Valid""PRECONDITION ""POSTCONDITION ")
% (smash)
% (skosimp∗ : preds? t)
% RequiredAxioms:
% size_of(typ)
% const and volatilemodels

% (auto−rewrite
% "address_of_spec""address_of_spec2""add_simplification "
% "address_add_zero ""address_add_sum "
% "add_spec""add_spec2""same_array_spec ""same_array_spec2 "
% "mod_range""size_of""uidt""check_bounds_spec "
% "er_plus_ax""er_minus_ax ""er_div_ax""er_times_ax""er_neg_ax"

136

B.9 cpp-examples.pvs

% "extended_real_superset_of_number_fields ")
% Rewrite: Expressions
% (auto−rewrite
% "literal""id""member""postinc""postdec""deref""arrow"
% "unary_minus""unary_minus_unsigned ""unary_not""unary_bitnot"
% "preinc""predec""UnaryExpressions .sizeof""ptm_member""ptm_arrow"
% "arrow""times""div""div_float""mod""plus""plus_ptr"
% "postinc_ptr""preinc_ptr""subscript""minus""minus_ptr"
% "postdec_ptr""predec_ptr""minus_ptr_ptr ""cmp""lt""gt""le""ge"
% "lt_ptr""gt_ptr""le_ptr""ge_ptr"
% "cmp_pointer""eq_bool""eq""not_equal""not_equal_bool""eq_ptr"
% "not_equal_ptr""bitand""bitxor""bitor""and_exp""or_exp"
% "conditional_expr ""assign""assign_times""assign_div""assign_mod"
% "assign_div_float ""assign_plus""assign_plus_ptr ""assign_minus"
% "assign_minus_ptr ""assign_bitand""assign_bitxor""assign_bitor"
% "comma")
% Rewrites: PlainMemory
% (auto−rewrite
% "plain_memory_write_ok_single "
% "plain_memory_read_data_ok "
% "plain_memory_write_ok_q_expr "
% "plain_memory_write_ok_q_stmt "
% "in_blessed_memory_rw_ro "
% "pm_q_prop_ok "
% "pm_q_prop_single_read "
% "pm_q_prop_single_write "
% "pm_q_prop_read_write_single "
% "pm_q_prop_read_write_other_single "
% "pm_q_prop_read_read_single "
% "plain_memory_read_write_other_single_data "
% "plain_memory_read_read "
% "plain_memory_read_write_res "
% "pm_q_prop_read_ok_expr "
% "pm_q_prop_read_ok_stmt "
% "pm_q_prop_read_pm_q_prop_expr "
% "pm_q_prop_read_pm_q_prop_stmt "
% "pm_q_prop_read_write_q_expr "
% "pm_q_prop_read_write_q_stmt "
% "plain_memory_read_write_q_data_expr "
% "plain_memory_read_write_q_data_stmt "
% "pm_q_prop_read_write_other_q_expr "
% "pm_q_prop_read_write_other_q_stmt "
% "pm_q_prop_read_read_q_expr "
% "pm_q_prop_read_read_q_stmt "
% "plain_memory_read_write_other_q_data_expr "
% "plain_memory_read_write_other_q_data_stmt "
% "plain_memory_read_read_q_data_expr "
% "plain_memory_read_read_q_data_stmt "
% "pm_q_prop_ok_result_single "
% "pm_q_prop_ok_result_q_expr "

137 B PVS Theory Sources

% "pm_q_prop_ok_result_q_stmt "
% "pm_q_prop_read_ok_result_single "
% "pm_q_prop_read_ok_result_q_expr "
% "pm_q_prop_read_ok_result_q_stmt "
% "pm_q_prop_e2s "
% "pm_q_prop_stmt_e2s "
% "pm_q_prop_read_e2s "
% "pm_q_prop_read_stmt_e2s "
% "pm_q_prop_read_ok__pm_q_prop_read_expr "
% "pm_q_prop_read_ok__pm_q_prop_read_stmt "
% )
% Rewrite: Switch
% (auto−rewrite
% "if_else"
% "switch"
% "member"
% "break_catch_break "
% "break_break_stmt "
% "break_break_catch_continue "
% "break_break_catch_default "
% "break_break_lift_stmt "
% "break_break_case "
% "break_break_default "
% "break_break"
% "stmt_break_break "
% "break_stmt_break "
% "break_stmt_catch_continue "
% "break_stmt_catch_default "
% "break_stmt_lift "
% "break_stmt_case"
% "break_stmt_default "
% "continue_catch_continue "
% "continue_break_stmt "
% "continue_break_catch_continue "
% "continue_break_catch_default "
% "continue_break_lift_stmt "
% "continue_break_case "
% "continue_break_default "
% "continue_continue"
% "stmt_continue_continue "
% "continue_stmt_continue "
% "continue_stmt_catch_continue "
% "continue_stmt_catch_default "
% "continue_stmt_lift "
% "continue_stmt_case "
% "continue_stmt_default "
% "switch_stmt"
% "stmt_switch_stmt "
% "switch_case_taken "
% "stmt_switch_case_taken "
% "switch_case_not_taken "

138

B.9 cpp-examples.pvs

% "stmt_switch_case_not_taken "
% "switch_default"
% "stmt_switch_default "
% "switch_catch_break "
% "stmt_switch_catch_break "
% "switch_catch_continue "
% "stmt_switch_catch_continue "
% "switch_catch_default "
% "stmt_switch_catch_default "
% "default_stmt"
% "stmt_default_stmt "
% "default_case"
% "stmt_default_case "
% "default_default"
% "stmt_default_default "
% "default_catch_break "
% "stmt_default_catch_break "
% "default_catch_continue "
% "stmt_default_catch_continue "
% "default_catch_default "
% "stmt_default_catch_default "
% "return_void_result "
% "return_ex_result "
% "stmt_remove_catch_default "
% "stmt_remove_case"
% "stmt_remove_default "
% "stmt_remove_catch_continue "
% "stmt_remove_catch_break "
% "break_break_stmt_expr "
% "break_break_catch_continue_expr "
% "break_break_catch_default_expr "
% "break_break_lift_stmt_expr "
% "break_break_case_expr "
% "break_break_default_expr "
% "continue_break_stmt_expr "
% "continue_break_catch_continue_expr "
% "continue_break_catch_default_expr "
% "continue_break_lift_stmt_expr "
% "continue_break_case_expr "
% "continue_break_default_expr "
% )
% Rewrite: Skip / E2S
% (auto−rewrite
% "skip_ok"
% "skip_state"
% "skip_elemination "
% "stmt_skip_elemination "
% "stmt_ok_lift"
% "stmt_ok_lift_expr "
% "e2s_ok"
% "stmt_e2s_ok"

139 B PVS Theory Sources

% "e2s_state"
% "stmt_e2s_state"
% "ok_result_fexpr "
% "ok_result_fstmt "
% "e2s_merge"
% "stmt_e2s_merge"
% "e2s_expr"
% "stmt_e2s_expr"
% )

% Rewrite: Loopsby unrolling
% (auto−rewrite
% "while_unroll"
% "stmt_while_unroll "
% "iterate_while_ok "
% "while_hang"
% "while_unroll_expr "
% "while_unroll_lexpr "
% "stmt_while_unroll_expr "
% "stmt_while_unroll_lexpr "
% "while_unroll_0 "
% "do_while_unroll "
% "do_while_inv_unroll "
% "for_unroll"
% "for_inv_unroll "
% "while_to_while_no_cb "
% "while_invariant ?!"
% "while_variant ?!"
% "while_inv_rewrite_termination_result !"
% "while_inv_rewrite_data_ok !"
% "while_inv_rewrite_data_break !"
% "while_inv_rewrite_data_return !"
% "stmt_while_inv_rewrite_termination_result !"
% "stmt_while_inv_rewrite_data_ok !"
% "stmt_while_inv_rewrite_data_break !"
% "stmt_while_inv_rewrite_data_return !"
% "pm_q_prop_while !"
% "pm_q_prop_stmt_while !"
% )
% Rewrite: Composition
% (auto−rewrite
% "composition_assoc_rewrite_stmt_ok "
% "forward_s_c_s_of_s_expr "
% "comp_eval_if_ok_fstmt "
% "stmt_eval_if_ok_fstmt "
% "comp_eval_if_ok_fstmt_cstmt "
% "stmt_eval_if_ok_fstmt_cstmt "
% "composition_assoc_rewrite_1 "
% "composition_assoc_rewrite_2 "

140

B.9 cpp-examples.pvs

% "composition_assoc_rewrite_3 "
% "composition_assoc_rewrite_4 "
% "composition_assoc_rewrite_5 "
% "composition_assoc_rewrite_6 "
% "composition_assoc_rewrite_7 "
% "composition_assoc_rewrite_8 "
% "composition_assoc_rewrite_expr_1 "
% "composition_assoc_rewrite_expr_2 "
% "composition_assoc_rewrite_expr_3 "
% "composition_assoc_rewrite_expr_4 "
% "composition_assoc_rewrite_expr_5 "
% "composition_assoc_rewrite_expr_6 "
% "composition_assoc_rewrite_stmt_ok "
% "composition_assoc_rewrite_stmt_ok_expr "
% "composition_assoc_rewrite_stmt_ok_expr_lexpr "
% "comp_eval_if_ok_fstmt "
% "comp_eval_if_ok_fstmt_expr "
% "comp_eval_if_ok_fstmt_cstmt_expr "
% "stmt_eval_if_ok_fstmt_expr "
% "stmt_eval_if_ok_fstmt_cstmt_expr "
% "comp_eval_if_ok_fexpr_expr "
% "comp_eval_if_ok_fexpr "
% "stmt_eval_if_ok_fexpr "
% "expr_eval_if_ok_fexpr "
% "composition_assoc_expression_rewrite "
% "composition_assoc_expression_rewrite_stmt "
% "stmt_eval_if_ok_fexpr_expr "
% "expr_eval_if_ok_fexpr_expr "
% "ok_result_fexpr "
% "ok_result_fstmt "
% "composition_assoc_rewrite_stmt_ok_cstmt "
% )
% Rewrite: Allocation
% (auto−rewrite
% "allocate_stack""deallocate_stack""with_new_stackvar "
% )
% Rewrite: Ok Result
% (auto−rewrite
% "ok_result_ok"
% "ok_result_data "
% "ok_result_q_ok "
% "ok_result_q_state "
% "ok_result_q_data "
% "ok_result_elemination_1 "
% "ok_result_elemination_2 "
% "ok_result_state"
% )
% Rewrite: Conversions
% (auto−rewrite

141 B PVS Theory Sources

% "l2r""integral_to_bool ""pointer_to_bool ""bool2int"
% )
% Rewrite: Precondrules
% (auto−rewrite
% "comp_simple_expr_simple_expr_ok "
% "comp_simple_expr_simple_expr_data "
% "comp_simple_expr_simple_expr_state "
% "comp_simple_stmt_simple_expr_ok "
% "comp_simple_stmt_simple_expr_data "
% "comp_simple_stmt_simple_expr_state "
% )

B.10 cpp-verification.pvs

% $Id: cpp−verification.pvs,v 1.2.6.1.4.1 2008/05/13 14:47:26 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

%

% Verificationenvironmentfor C++. Maintheory, importsall other theories
% that are needed to verifyC++ programsin PVS.
Cpp_Verification[State : Type] : THEORY

BEGIN

Importing Expressions, Conversions, Hoare, Statement_Rewrites
pm : Plain_Memory[State]
END Cpp_Verification

B.11 datatype_model.pvs

% $Id: datatype_model.pvs,v 1.1.6.2.4.2 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

%

% A definitionof two PODswithdifferent"typetags",where
% read_data(pm, pod_2)(addr) after write_data(pm, pod_1)(addr) fails.

%

% Thisis merelyan example.

%

% The contentsof this file shouldprobablybe movedto "builtin_models.pvs"
% when the lattertypechecksagain.
% Note that there is (yet another) problemwiththe currentPOD formalization:
% it does not guaranteethat PODscan be copied via char arrays.
% Two trivialPODs, both withunitsemantics.

142

B.11 datatype_model.pvs

Datatype_Model: THEORY

BEGIN

IMPORTING Unit, Interpreted_Data[Unit]
% proof status:−)
% uidt_1_TCC1: TCCObligation
uidt_1: (uninterpreted_data_type ?) =
(# size := 1,
valid? := LAMBDA (bl: list[Byte], a : Address):
bl = (: 0 :)

#)

% proof status:−)
% pod_1_TCC1: TCCObligation
% proof status:−)
% pod_1_TCC2: TCCObligation
% proof status:−)
% pod_1_TCC3: TCCObligation
% proof status:−)
% pod_1_TCC4: TCCObligation
pod_1: (pod_data_type ?) =
(# uidt := uidt_1,
to_byte:= LAMBDA (d: Unit, a : Address):
(: 0 :),
to_mask:= Lambda (d : Unit, a : Address) :
zero_mask?(size(uidt_1)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if bl = (: 0 :) then up(unit) else bottom endif

#)

% proof status:−)
% uidt_2_TCC1: TCCObligation
uidt_2: (uninterpreted_data_type ?) =
(# size := 1,
valid? := LAMBDA (bl: list[Byte], a : Address):
bl = (: 1 :)

#)

% proof status:−)
% pod_2_TCC1: TCCObligation
% proof status:−)
% pod_2_TCC2: TCCObligation

143 B PVS Theory Sources

% proof status:−)
% pod_2_TCC3: TCCObligation
pod_2: (pod_data_type ?) =
(# uidt := uidt_2,
to_byte:= LAMBDA (d: Unit, a : Address):
(: 1 :),
to_mask:= Lambda (d : Unit, a : Address) :
zero_mask?(size(uidt_2)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if bl = (: 1 :) then up(unit) else bottom endif

#)

END Datatype_Model
Read_After_Write_Fails [State : Type] : THEORY

BEGIN

IMPORTING Datatype_Model, Statements, Plain_Mem_Properties [State]
pm : VAR Plain_Memory[State]
s : VAR State
a : VAR Address
% proof status:−)
% plain_mem_write_list_states_TCC1 : TCCObligation
% proof status:−)
plain_mem_write_list_states : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
pm‘states(state(memory_write_list (pm‘mem)(a, bl)(s)))
% proof status:−)
plain_mem_write_list_read_list_ok : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
OK?(memory_read_list (pm‘mem)(a, size)
(state(memory_write_list (pm‘mem) (a, bl)(s))))
% proof status:−)
Fatal_Result: LEMMA
plain_memory?(pm) and
pm‘states(s) and

144

B.11 datatype_model.pvs

in_blessed_memory ?(pod_1, a, pm‘rw_addr) implies
Fatal?( (write_data(pm, pod_1)(a, unit) ##
read_data(pm, pod_2)(a))(s) )
END Read_After_Write_Fails

% The same for two perhapsmore interestingPODs: bool and Byte.
Datatype_Model_2: THEORY

BEGIN

IMPORTING Interpreted_Data[bool]
% proof status:−)
% uidt_bool_TCC1: TCCObligation
uidt_bool: (uninterpreted_data_type ?) =
(# size := 2,
valid? := LAMBDA (bl: list[Byte], a : Address):
bl = (: 0, 0 :) or bl = (: 0, 1 :)

#)

% proof status:−)
% pod_bool_TCC1: TCCObligation
% proof status:−)
% pod_bool_TCC2: TCCObligation
% proof status:−)
% pod_bool_TCC3: TCCObligation
% proof status:−)
% pod_bool_TCC4: TCCObligation
% proof status:−)
% pod_bool_TCC5: TCCObligation
% proof status:−)
% pod_bool_TCC6: TCCObligation
pod_bool: (pod_data_type ?) =
(# uidt := uidt_bool,
to_byte:= LAMBDA (d: bool, a : Address):
if d then (: 0, 1 :) else (: 0, 0 :) endif,
to_mask:= Lambda (d : bool, a : Address) :
zero_mask?(size(uidt_bool)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if bl = (: 0, 1 :) then up(true)
else if bl = (: 0, 0 :) then up(false)
else bottom endif endif

#)

145 B PVS Theory Sources

IMPORTING Interpreted_Data[Byte]
% proof status:−)
% uidt_Byte_TCC1: TCCObligation
% proof status:−)
% uidt_Byte_TCC2: TCCObligation
uidt_Byte: (uninterpreted_data_type ?) =
(# size := 2,
valid? := LAMBDA (bl: list[Byte], a : Address):
length(bl) = 2 and car(bl) = 1

#)

% proof status:−)
% pod_Byte_TCC1: TCCObligation
% proof status:−)
% pod_Byte_TCC2: TCCObligation
% proof status:−)
% pod_Byte_TCC3: TCCObligation
% proof status:−)
% pod_Byte_TCC4: TCCObligation
% proof status:−)
% pod_Byte_TCC5: TCCObligation
pod_Byte: (pod_data_type ?[Byte]) =
(# uidt := uidt_Byte,
to_byte:= LAMBDA (d: Byte, a : Address):
(: 1, d :),
to_mask:= Lambda (d : Byte, a : Address) :
zero_mask?(size(uidt_Byte)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if length(bl) = 2 and car(bl) = 1 then up(car(cdr(bl))) else bottom endif

#)

END Datatype_Model_2

Read_After_Write_Fails_2 [State : Type] : THEORY

BEGIN

IMPORTING Datatype_Model_2 , Statements, Plain_Mem_Properties [State]
pm : VAR Plain_Memory[State]
s : VAR State
a : VAR Address

146

B.12 device_memory.pvs

% proof status:−)
plain_mem_write_list_states : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
pm‘states(state(memory_write_list (pm‘mem)(a, bl)(s)))
% proof status:−)
plain_mem_write_list_read_list_ok : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
OK?(memory_read_list (pm‘mem)(a, size)
(state(memory_write_list (pm‘mem) (a, bl)(s))))
% proof status:−)
Fatal_Result: LEMMA
plain_memory?(pm) and
pm‘states(s) and
in_blessed_memory ?(pod_bool, a, pm‘rw_addr) implies
Fatal?( (write_data(pm, pod_bool)(a, true) ##
read_data(pm, pod_Byte)(a))(s) )
END Read_After_Write_Fails_2

B.12 device_memory.pvs

Expand_State[State, T : Type] : Theory

Begin

Importing State_Transformer
Expand_state: Type = [#
state : State,
expansion : T

#]

em_lift(stf : [State −> SuperResult[State]]) :
[Expand_state−> SuperResult[Expand_state]] =
Lambda (s : Expand_state) :
Let res = stf(s‘state) In
Cases res Of
OK(state) : OK(s With [(state) := state]),
Abnormal(state) : Abnormal(s With [(state) := state]),
Bottom : Bottom

147 B PVS Theory Sources

EndCases

em_lift(P : PRED[State]) : PRED[Expand_state] =
Lambda (em : Expand_state) : P(em‘state)
em_lift(P : PRED[[State −> SuperResult[State]]])
(q : [Expand_state−> SuperResult[Expand_state]]) : bool =
Exists (p : (P)) : q = em_lift(p)
states : Var PRED[State]
transformers : Var PRED[[State −> SuperResult[State]]]
% proof status:−)
em_transformers_ok: Lemma
transformers_ok?(states, transformers) Implies
transformers_ok?(em_lift(states), em_lift(transformers))
% proof status:−)
em_transformer_invariant: Lemma
transformer_invariant?(states, transformers) Implies
transformer_invariant?(em_lift(states), em_lift(transformers))
% proof status:−)
em_lift_singleton: Lemma
Forall (q : [State −> SuperResult[State]]) :
singleton(em_lift(q)) = em_lift(singleton(q))
End Expand_State
Expand_State2[State, T, Data : Type] : Theory

Begin

Importing Expand_State[State, T]
em_lift(stf : [State −> ExprResult[State, Data]]) :
[Expand_state−> ExprResult[Expand_state, Data]] =
Lambda (s : Expand_state) :
Let res = stf(s‘state) In
Cases res Of
OK(state, data) : OK(s With [(state) := state], data),
Exception(ex_type, state) : Exception(ex_type, s With [(state) := state]),
Fatal : Fatal,
Hang : Hang

EndCases

% proof status:−)
em_lift_expr_2_super : Lemma
Forall (stf : [State −> ExprResult[State, Data]]) :
expr_2_super (em_lift(stf)) = em_lift(expr_2_super (stf))
End Expand_State2

148

B.12 device_memory.pvs

Expand_State3[State, T : Type] : Theory

Begin

Importing Expand_State2, Plain_Memory
pm : Var Memory_struct[State]
em_pm: Var Memory_struct[Expand_state[State, T]]
states : Var PRED[State]
addresses : Var PRED[Address]
transformers : Var PRED[[State −> SuperResult[State]]]
% proof status:−)
em_memory_read_transformers : Lemma
(em_pm‘memory_read=
Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a)))

Implies

memory_read_transformers (em_pm, addresses) =
em_lift(memory_read_transformers (pm, addresses))
% proof status:−)
em_memory_write_transformers : Lemma
(em_pm‘memory_write=
Lambda (a : Address, b : Byte) :
em_lift[State, T, Unit](pm‘memory_write(a, b)))

Implies

memory_write_transformers (em_pm, addresses) =
em_lift(memory_write_transformers (pm, addresses))
% proof status:−)
em_unchanged_memory_invariant : Lemma
(em_pm‘memory_read= Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a))) And
unchanged_memory_invariant ?(pm, states, transformers, addresses)

Implies

unchanged_memory_invariant ?(em_pm, em_lift(states),
em_lift(transformers), addresses)
% proof status:−)
em_changed_memory_invariant : Lemma
(em_pm‘memory_read=
Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a))) And
(em_pm‘memory_write=
Lambda (a : Address, b : Byte) :
em_lift[State, T, Unit](pm‘memory_write(a, b))) And
changed_memory_invariant ?(pm, states, addresses)

Implies

changed_memory_invariant ?(em_pm, em_lift(states), addresses)
% proof status:−)
% em_const_unchanged_memory_invariant_TCC1 : TCCObligation
% proof status:−)

149 B PVS Theory Sources

em_const_unchanged_memory_invariant : Lemma
Forall (q : [Expand_state[State, T] −> SuperResult[Expand_state[State, T]]]) :
(em_pm‘memory_read= Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a))) And
(Forall (s : Expand_state[State, T]) : has_next_state (q(s)) Implies state(q(s))‘state = s‘state)

Implies

unchanged_memory_invariant ?(em_pm, em_lift(states), singleton(q), addresses)
se_transformer: Var
[Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]
% proof status:−)
em_side_effect_content_unchanged : Lemma
side_effect_content_unchanged (addresses, states, se_transformer)

Implies

side_effect_content_unchanged (addresses, em_lift(states),
Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[State, T, list[Byte]](se_transformer(a, bl, cp)))
End Expand_State3

Device_Memory[Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm : Plain_Memory,
Device_state: Type] : Theory

Begin

Importing Expand_State3
Device_memory: Type = Expand_state[Physical_memory, Device_state]
s : Var Device_memory
a : Var Address
b : Var Byte
size : Var nat
device_read_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
device_write_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
device_pm(device_read_side_effect ,
device_write_side_effect ) : Memory_struct[Device_memory] =

(#

memory_read:= Lambda (a : Address) :
em_lift[Physical_memory, Device_state, Byte](memory_read(pm‘mem)(a)),
memory_write:= Lambda (a : Address, b : Byte) :
em_lift[Physical_memory, Device_state, Unit](memory_write(pm‘mem)(a, b)),

memory_read_side_effect

:=

Lambda (a : Address, bl : list[Byte], cp : bool) :

150

B.12 device_memory.pvs

em_lift[Physical_memory, Device_state, list[Byte]](
memory_read_side_effect (pm‘mem)(a, bl, cp)) ## Lambda (bl1 : list[Byte]) :
device_read_side_effect (a, bl1, cp),

memory_write_side_effect

:=

Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[Physical_memory, Device_state, list[Byte]](
memory_write_side_effect (pm‘mem)(a, bl, cp)) ## Lambda (bl1 : list[Byte]) :
device_write_side_effect (a, bl1, cp)

#)

End Device_Memory
Challenge_Device_Memory[Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory,
Device_state: Type] : Theory

Begin

Importing Device_Memory[Physical_memory, pm_phy, Device_state],

Plain_Mem_Rewrites

device_read_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
device_write_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
addresses : Var PRED[Address]
pm : Var Plain_Memory[Device_memory]
drse_super_transformers (addresses, device_read_side_effect ) :
PRED[[Device_memory−> SuperResult[Device_memory]]] =
Lambda (q : [Device_memory−> SuperResult[Device_memory]]) :
Exists (a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (device_read_side_effect (a, bl, cp))
dwse_super_transformers (addresses, device_write_side_effect ) :
PRED[[Device_memory−> SuperResult[Device_memory]]] =
Lambda (q : [Device_memory−> SuperResult[Device_memory]]) :
Exists (a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (device_write_side_effect (a, bl, cp))

is_device_plain_memory ?(device_read_side_effect , device_write_side_effect )
(pm) : bool =
% plainmemory
pm‘mem = device_pm(device_read_side_effect , device_write_side_effect ) And
plain_memory?(pm_phy) And

151 B PVS Theory Sources

pm‘states = em_lift(pm_phy‘states) And
subset?(pm‘other_actions, em_lift(pm_phy‘other_actions)) And
subset?(pm‘rw_addr, pm_phy‘rw_addr) And
subset?(pm‘ro_addr, union(pm_phy‘ro_addr, difference(pm_phy‘rw_addr, pm‘rw_addr))) And
% side effect properties
transformers_ok?(pm‘states, union(
drse_super_transformers (union(pm‘ro_addr, pm‘rw_addr),

device_read_side_effect

),

dwse_super_transformers (pm‘rw_addr, device_write_side_effect ))) And
unchanged_memory_invariant ?(pm‘mem, pm‘states, union(
drse_super_transformers (union(pm‘ro_addr, pm‘rw_addr),

device_read_side_effect

),

dwse_super_transformers (pm‘rw_addr, device_write_side_effect )),
union(pm‘ro_addr, pm‘rw_addr)) And
side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
device_read_side_effect ) And
side_effect_content_unchanged (pm‘rw_addr, pm‘states,

device_write_side_effect

)

% HelperLemmas
% −−−−−−−−−−−−−−−
% proof status:−)
pm_dev_plain: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

plain_memory?(pm_phy)
% proof status:−)
pm_dev_states: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

pm‘states = em_lift(pm_phy‘states)
% proof status:−)
pm_dev_read: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_read(pm‘mem) =
Lambda (a : Address) :
em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy‘mem)(a))
% proof status:−)
pm_dev_write: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_write(pm‘mem) =
Lambda (a : Address, b : Byte) :
em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy‘mem)(a, b))

152

B.12 device_memory.pvs

% proof status:−)
pm_dev_read_side_effect : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_read_side_effect (pm‘mem) =
Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[Physical_memory, Device_state, list[Byte]](
memory_read_side_effect (pm_phy‘mem)(a, bl, cp)) ## lambda (bl1 : list[Byte]) :
device_read_side_effect (a, bl1, cp)
% proof status:−)
pm_dev_write_side_effect : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_write_side_effect (pm‘mem) =
Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[Physical_memory, Device_state, list[Byte]](
memory_write_side_effect (pm_phy‘mem)(a, bl, cp)) ## lambda (bl1 : list[Byte]) :
device_write_side_effect (a, bl1, cp)
% proof status:−)
pm_dev_ro_rw_addr : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

subset?(union(pm‘ro_addr, pm‘rw_addr), union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% PlainMemoryProperties
% −−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
device_plain_transformers_ok : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

transformers_ok?(pm‘states, union(
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr)))
% proof status:−)
device_plain_unchanged_memory_invariant : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states, union(union(pm‘other_actions,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))),

153 B PVS Theory Sources

union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
device_plain_unchanged_memory_invariant_write : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr), pm‘ro_addr)
% proof status:−)
device_plain_unchanged_memory_write_invariant : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

unchanged_memory_write_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
device_plain_changed_memory_invariant : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

changed_memory_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
device_plain_read_side_effect_unchanged : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
memory_read_side_effect (pm‘mem))
% proof status:−)
device_plain_write_side_effect_unchanged : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

side_effect_content_unchanged (pm‘rw_addr, pm‘states,
memory_write_side_effect (pm‘mem))
% proof status:−)
device_plain_transformers_ok2 : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

transformers_ok?(pm‘states, union(
memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr)))
% MainBlessingResult
% ======================

154

B.13 everything.pvs

% proof status:−)
device_memory_plain_memory : Lemma
Forall (pm) :
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)
Implies plain_memory?(pm)
End Challenge_Device_Memory

B.13 everything.pvs

Import_All: Theory
% Thistheoryimports(directlyor indirectly) ∗every∗ theory
% of the project. Thisway one can convenientlyrerunall proofs
% withprove−importchain(C−c C−p i) on this theory.

Begin

% Please add all new theorieshere !!
Importing Phy_Mem_Challenge_Read_Same , Phy_Mem_Challenge_Read_Other ,

Linear_Memory_Blessing_Properties

,

Statement_Rewrites

,

Allocation_Table, Challenge_Random_Device , Expressions
% data typemodels
Importing PDBR_Data_Model , PDE_Model, PTE_Model, PF_EC_Model , Address_Model
% test theories
Importing Rewrite_Test, Search_Example, Cpp_Examples
Importing Read_After_Write_Fails , Read_After_Write_Fails_2
% intermediatestuff, that willdisappearlater
Importing PDBR_Datatype, PDE_Datatype, PTE_Datatype,
Physical_Memory_Corollaries , Block_Disjoint_Rewrites ,
Posnat_induction, Set_Lift

End Import_All

B.14 expressions.pvs

% $Id: expressions.pvs,v 1.34.2.2.2.5.2.4 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber(based on lecturematerialby HendrikTews)
% (c) 2007 RadboudUniversity

%

% A shallowembeddingof (some) C++ expressionsas state transformers.
% Section numbersin commentsthroughoutthis file refer to
% "Programminglanguages− C++", ISO/IEC14882:1998(E)

155 B PVS Theory Sources

% Deviationsfrom the C++ standard:
% ===================================

%

% EvaluationOrder
% −−−−−−−−−−−−−−−−−−
% Note that the C++ standardleavesthe evaluationorderof subexpressions
% mostlyunspecified. The behavioris undefinedunlesseach expression
% satisfiesa (somewhatobscure) side condition(cf. 5.4). We do not model
% this here; the followingdefinitionsinsteaduse some fixedevaluationorder.
% MichaelNorrishin his paper
% "Deterministicexpressionsin C",8th EuropeanSymposiumon Programming
% (ETAPS), Amsterdam. 1999. LNCS1576, pp147−161
% shows that the evaluationorderis actuallyirrelevantfor expressionsthat
% satisfythe side conditionof 5.4. At the source code level, the evaluation
% ordercan be made deterministicby disallowingoperandswithside effects,
% storingtheirvaluesin temporaryvariablesinstead: e.g.
% x = f() + g();
% could be replacedby
% t1 = f(); t2 = g(); x = t1 + t2;

%

% ModuloArithmetic
% −−−−−−−−−−−−−−−−−−−
% C++ definessome typesand theircorrespondingoperationsto follow
% arithmeticmodulo2^n where n is the numberof bits in the value
% representation. To be able detect integeroverflowswe do not model modulo
% arithmeticdirectlybut insteadwe add the functionmod whichis definedto
% be the identityfunctionfor the valuerange of the respectivedatatypebut
% whichis otherwiseundefined.

%

% Integerdivision"/"and remainder"%" (5.6.4) behavedifferently, see below.

%

% Bit−shift operators"<<" and ">>" (5.8.1) behavedifferently; see below.
% Open Issues:
% =============
% − CallingConvention(5.2 functions)
% I don’t thinkthe C++ standardspecifiesjust how exactlyfunction
% argumentsare stored on the stack (or even if there is a stack, for.that
% matter.) "call_f"obviouslydefinesa certain(hopefullyreasonable)
% behavior.

%

% Thisis definedin the ABIdocuments. (e.g., cdecl is definedin
% the callingconventionis definedin 3.9 in the "SystemV ABIIntel386
% ArchitectureProcessorSupplement")

%

% − passingvaluesto functionsratherthan addresses(5.2 functions)
% Forspecification/verification, it mightbe useful to have yet anotherPVS
% functionfor f whichtakes values(ratherthan expressionsor addresses) as
% arguments. Thishasn’t been implementedyet.

%

% − entrypoints+ addressranges for functions(5.2 functions)
% We shouldprobablydefine for each functionthe range of addresseswhere

156

B.14 expressions.pvs

% the code of this functionresidesand the addressof the entrypoint

%

% − shouldwe implementexceptionvalues; some FPUops and div0 generatea
% well−definedhardwareexception(e.g., Exception0: divideerror). Using
% Extended_Realssuch an implementationcould specifyexceptionvalues(e.g.,
% x / 0 = div_0), check for these valuesand insteadof exitingwithFatal
% returnwiththe appropriateexception.
% To do:
% ========
% − define expressionsfor bitfieldtypes
% − with_new_refvar (ref, init)(Lambda(ref : (range(ref))) : xxx)
% − define << and >> operator
% − addressof operator(&)
% − pointerassignment
% on assignmentwe have to adjustthe pointeraddressto refer to the
% base class subobjectof a derivedobject.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.1: Primaryexpressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
PrimaryExpressions[State, Data : Type] : THEORY

BEGIN

IMPORTING State_Transformer_Lift
x : VAR Data
% 5.1.2
% >> MV: use Cpptype; define literalsfor int, char, float, bool // string
literal(x) : [State −> ExprResult[State, Data]] = ok_result(x)
% 5.1.7
% >> MV: x is alwaysan address(??)
id(x) : [State −> ExprResult[State, Data]] = ok_result(x)
END PrimaryExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.2: Postfixexpressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% A C++ function"ret_dataf(arg_dataa)"currentlycorrespondsto two PVS
% functions

%

% f(a : Address) : [State −> StmtResult[State, Semantics_< ret_data>]] =

157 B PVS Theory Sources

% body

%

% (where each branchin the bodymust be terminatedby a "return"statement)
% and

%

% call_f(a : [State −> ExprResult[State, Semantics_< arg_data>]]) :
% [State −> ExprResult[State, Semantics_< ret_data>]] =
% with_new_stackvar ( lambda(a_addr: Address):
% assign(a_addr, a) ##
% f(a_addr)) ##
% catch_return
PostfixExpressions[State : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , Cpp_Types
pm : VAR Plain_Memory[State]
a_ex: VAR ET[State, Address]
% 5.2.5: Classmemberaccess
member(a_ex, (offset : nat)) : [State −> ExprResult[State, Address]] =

(

a_ex## lambda (a : Address):
ok_result(a + offset)

)

% 5.2.1: Subscripting
% "The expressionE1[E2] is identical(by definitionto ∗((E1) + (E2))
% see subscriptin arithmeticexpressions
% 5.2.5 pt 3: −> operator
% "the expressionE1−> E2 is convertedto the equivalentfrom (∗(E1)).E2
% see arrowin unaryexpressions

% proof status:−)
% postinc_TCC1: TCCObligation
% 5.2.6 pt 1: C++’ s .++ operator
postinc(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, (range(typ))] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n + 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n + 1)) ##
ok_result(n)

Else

fatal_result Endif

158

B.14 expressions.pvs

)

% proof status:−)
% postinc_float_TCC1: TCCObligation
% proof status:−)
% postinc_float_TCC2: TCCObligation
% proof status:−)
% postinc_float_TCC3: TCCObligation
% >> exampleof floatingpointoperation
postinc_float(pm, (typ : Cpp_Subtype(v(floating_point?))))(a_ex) :
ET[State, (range_floating_point (cv_base(typ)))] =

(

a_ex## lambda (a : Address):
read_data(pm, dt_cv_float (typ))(a) ##
lambda (n : (range_floating_point (cv_base(typ)))):
If range_floating_point (cv_base(typ))(mod_float(cv_base(typ))(er_plus(n, 1))) Then
write_data(pm, dt_cv_float (typ))(a, mod_float(cv_base(typ))(er_plus(n, 1))) ##
ok_result(n)

Else

fatal_result Endif

)

% 5.2.6 pt 1: C++‘ s ++ operatorfor pointersto completeobject
% deferredto arithmeticexpressions
% 5.2.6 pt 1
% .++ for argumenttypebool (deprecated)
% 5.2.6 pt 2: C++’ s .−− operator
% .−− is not definedfor argumenttypebool
postdec(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, (range(typ))] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n − 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n − 1)) ##
ok_result(n)

Else

fatal_result Endif

)

% To do: postdec_float
% 5.2.6 pt 2: C++’ s .−− operatorfor pointersto completeobject
% deferredto arithmeticexpressions

159 B PVS Theory Sources

% 5.2.7 dynamic_cast
% TODO: definitionof dynamic_cast(5.2.7)
% 5.2.8 typeid
% TODO: definitionof typeid(5.2.8)
% 5.2.9 static_cast
% TODO: definitionof static_cast(5.2.9)
% − static_cast< reference_type>( v) = lvalueotherwise= rvalue5.2.9.1
% − static_castcan onlyincreasequalifiedness(+ volatile/ + const)
% 5.2.10 reinterpret_cast
% TODO: define reinterpret_cast(5.2.10)
% − reinterpret_cast< reference_type>( v) = lvalueotherwise= rvalue5.2.10.1
% − reinterpret_cast<>( const v) = const 5.2.10.2
% − mappingis implementationdefined
% MV: we cannot define reinterpretcast in a generic way using
% from_byte(T2)(to_byte(T1)); (5.2.10.3) the representationmay or may
% not change !!!
% 5.2.11 const_cast
% TODO: define const_cast(5.2.11)
END PostfixExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.3: Unaryexpressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
UnaryExpressions[State : Type] : Theory

BEGIN

IMPORTING PostfixExpressions
pm : VAR Plain_Memory[State]
a_ex: Var ET[State, Address]
% proof status:−)
% deref_TCC1: TCCObligation
% 5.3.1: C++’ s ∗ operator
deref(pm, (p_typ: Cpp_Subtype(cv(pointer?))))
(p_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, Memory_Address] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(p_typ)))) :
If not_null?(p_typ)(ptr_val) And
check_bounds(p_typ)(ptr_val) And

160

B.14 expressions.pvs

up?(address_of(p_typ)(ptr_val))

Then

ok_result(down(address_of(p_typ)(ptr_val)))

Else

fatal_result Endif

)

% To do: ∗ for pointerto function
% proof status:−)
% arrow_TCC1: TCCObligation
% proof status:−)
% arrow_TCC2: TCCObligation
% 5.2.5 pt 3: −> operator
% "the expressionE1−> E2 is convertedto the equivalentfrom (∗(E1)).E2
arrow(pm, (p_typ: Cpp_Subtype(cv(Lambda (t : Cpp_Type) : pointer?(t) And
(class?(typ(t)) Or union?(typ(t)))))))
(p_ex: ET[State, (range_pointer(cv_base(p_typ)))], offset : nat) :
ET[State, Address] =

(

deref(pm, p_typ)(p_ex) ## Lambda (a : Address) :
member(ok_result(a), offset)

)

% 5.3.1 pt 2 C++’ s & operator
% not needed for variables; = member() for class members
% 5.3.1 pt 6 unary+ operator
% (not needed as it returnsthe valueof the argument)
% proof status:−)
% unary_minus_TCC1: TCCObligation
% proof status:−)
% unary_minus_TCC2: TCCObligation
% 5.3.1 pt 7 unary− operator
unary_minus(typ : Cpp_Subtype(cv({t : Cpp_Type|
(char?(t) Or wchar_t?(t) Or signed_integer?(t))})))
(n_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =

(

n_ex## lambda (n : (range(typ))) :
If range(typ)(mod(typ)(−n)) Then
ok_result(mod(typ)(−n))

Else

fatal_result Endif

)

161 B PVS Theory Sources

% To do: unary_minus_float
% proof status:−)
% unary_minus_unsigned_TCC1 : TCCObligation
% proof status:−)
% unary_minus_unsigned_TCC2 : TCCObligation
% 5.3.1 pt 7 "the negativeof an unsignedquantityis computedby
% substractingits valuefrom 2^n"
unary_minus_unsigned (typ : Cpp_Subtype(cv(unsigned_integer?)))
(n_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =

(

n_ex## lambda (n : (range(typ))) :
If range(typ)(mod(typ)(2^max_value_bits (typ) − n)) Then
ok_result(mod(typ)(2^max_value_bits (typ) − n))

Else

fatal_result Endif

)

% 5.3.1 pt 8: C++’ s ! operator
unary_not(typ : Cpp_Subtype(cv(bool?)))
(b_ex: ET[State, bool]) : ET[State, bool] =

(

b_ex## lambda (b : bool) :
ok_result(Not b)

)

% To do
% 5.3.1 pt 9 C++’ s ~ operator
% "The resultis the one’s complementof its operand."

%

% >> MV and Tjarkthink(hope) that this means we applyone’s complement
% to the binaryrepresentationand see whethera validvalue
% comes out of it.
unary_bitnot(typ : Cpp_Subtype(cv(non_bool_integral_enum ?)))
(n_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =

(

n_ex## lambda (n : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitnot_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), binary_not)
(to_byte(dt(typ))(n, a)), a)

In

If up?(bitnot_value) And range(typ)(down(bitnot_value)) Then
ok_result(down(bitnot_value))

Else fatal_result

162

B.14 expressions.pvs

Endif )

% proof status:−)
% preinc_TCC1: TCCObligation
% 5.3.2 pt 1: C++’ s ++. operator
% Note that the prefixincrement/decrementoperatorsreturnan lvalue(i.e.
% an address).
preinc(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n + 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n + 1)) ##
ok_result(a)

Else

fatal_result Endif

)

% To do: preinc_float
% 5.3.2 pt 1: C++’ s ++. operatorfor pointers
% deferredto arithmeticexpressions
% 5.3.2 pt 2: C++’ s −−. operator
% −−. is not definedfor argumenttypebool
predec(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n − 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n − 1)) ##
ok_result(a)

Else

fatal_result Endif

)

% To do: predec_float
% 5.3.2 pt 1: C++’ s −−. operatorfor pointers
% deferredto arithmeticexpressions
% proof status:−)
% sizeof_TCC1: TCCObligation
% 5.3.3 sizeof operator(onlythe typeparameterform is implemented)

163 B PVS Theory Sources

% TODO: define the typestd::size_tand returnthis typein sizeof
% this is elsa’s size_of_typeexpression

%

% 7.17 pt 2 C − Standard: size_tis an unsignedintegertype
sizeof(typ : Cpp_Type) : ET[State, (range(uint))] =
If range(uint)(size_of(typ)) Then
ok_result(size_of(typ))

Else

fatal_result Endif

% 5.3.4 C++ new operator
% TODO
% 5.3.5 C++ delete operator
% TODO
END UnaryExpressions
% 5.4 definitionof cast (T)exp
% TODO
PointerToMemberExpressions[State : Type] : THEORY

BEGIN

Importing UnaryExpressions
pm : VAR Plain_Memory[State]
a_ex: Var ET[State, Address]
% 10 pt 5 "A base class subobjectmighthave a layoutdifferentfrom the
% layoutof the most derivedobject of the same type."
% 9.2 pt 17 "A pointerto a pod−structobject, suitablyconvertedusing a
% reinterpret_cast, pointsto its initialmember[...]and vice
% versa."
% GCCseems to adjustthe addressesof a pointerupon pointerassignment. For
% example, in the assignmentB∗ bp = & a where class A : C, B {}; bp willbe
% set to pointto the B subobjectin A. Thisgoes as far as that a vtableis
% alloatedfor B. However, the vtablevalueis not identicalto a
% freestandingB.
% >> Könnenwir zeigen, das ein anderesVorgehenTypinformationin Pointernoder
% in Pointerauf Klassenmemberbraucht?
% >> Ich würdedaherpointerto memberexpressionswie folgt formalisieren:
% We assume that membersof a subobjectare not reorderedwithmembersof
% other subobjectsor withmembersof the derivedobject. We can therefore
% adjustthe pointerto pointto a base class. Thisbase class may possibly
% have a layoutdifferentfrom a standaloneobject.

164

B.14 expressions.pvs

%

% However, to detect this, typeinformationmust be stored withthe object.
% (??)

%

% We thus requirethe pointerto whichpointerto memberexpressionsare
% boundto have the same class as the pointerto member.
% proof status:−)
% ptm_member_TCC1: TCCObligation
% 5.5 pt 2 C++’ s .∗ operatorfor pointerto member
% To do:
% 5.5 pt 4 "If the dynamictypeof the object does not containthe member
% to whichthe pointerrefers, the behaviouris undefined."
% range(typ) onlycontainsoffsets that are validfor the possiblyderived
% class typ(typ).
ptm_member(typ : Cpp_Subtype(cv(pointer_to_member ?)))
(a_ex, (ptm_ex: ET[State, (range_ptm(cv_base(typ)))])) :
ET[State, Address] =

(

ptm_ex## Lambda (ofs : (range_ptm(cv_base(typ)))) :
% the offset of the member
member(a_ex, ofs)

)

% proof status:−)
% ptm_arrow_TCC1: TCCObligation
% 5.5 pt 3 C++‘ s −>∗ operatorfor pointerto member
% To do:
% check typ(ptr_typ) is a unambiguousaccessiblebase class of typ(ptm_typ).
ptm_arrow(pm, (ptm_typ: Cpp_Subtype(cv(pointer_to_member ?))))
(p_ex: ET[State, (range_pointer(cv_base(
pointer(typ(cv_base(ptm_typ))))))],
ptm_ex: ET[State, (range_ptm(cv_base(ptm_typ)))]) :
ET[State, Address] =

(

ptm_ex## Lambda (ofs : (range_ptm(cv_base(ptm_typ)))) :
arrow(pm, pointer(typ(cv_base(ptm_typ))))(p_ex, ofs)

)

END PointerToMemberExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.6: Multiplicativeoperators
% 5.7: Additiveoperators
% 5.8: Shift operators
% 5.9: Relationaloperators

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

165 B PVS Theory Sources

ArithmeticExpressions[State : Type] : THEORY

BEGIN

IMPORTING UnaryExpressions
pm : Var Plain_Memory[State]
a_ex: Var ET[State, Address]
i_typ: Var Cpp_Subtype(cv(non_bool_integral_enum ?))
% The standarddefinesthat bool valuesare subjectto integralpromotions:
% 5 pt 9 "Thispatternis calledthe ’usualarithmeticconversions’ ...
% Otherwise, the integralpromotion(4.5) shallbe performed."
% MultiplicativeOperators
% ==========================
% 5.6: C++’ s ∗ operator(multiplication)
times(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))) :
n2_ex## lambda (n2 : (range(i_typ))) :
If range(i_typ)(mod(i_typ)(n1 ∗ n2)) Then
ok_result(mod(i_typ)(n1 ∗ n2))

Else

fatal_result Endif

)

% To do: times_float
% 5.6.4: "If the second operandof / or % is zero the behavioris undefined;
% otherwise(a/b)∗b + a% b is equal to a. If both operandsare nonnegative
% then the remainderis nonegative; if not, the sign of the remainderis
% implementation−defined."
% C99 requirestruncationtowardszero
% proof status:−)
% mod_impl_TCC1: TCCObligation
% 5.6: C++’ s % operator(i % j resp. i / j)
mod_impl(i : int, j : {k : int | k /= 0}) : {r : int | abs(r) < abs(j)}
div_impl(i : int, j : {k : int | k /= 0}) : int
mod_impl_pos_range : Axiom
Forall (i, j : nat) : j /= 0 Implies
mod_impl(i, j) = mod(i, j)
% proof status:−)

166

B.14 expressions.pvs

% div_impl_pos_range_TCC1 : TCCObligation
div_impl_pos_range : Axiom
Forall (i, j : nat) : j /= 0 Implies
div_impl(i, j) = ndiv(i, j)
mod_impl_sign: Axiom
Forall (i : int, j : int) : j /= 0 And (i < 0 Or j < 0) Implies
mod_impl(i, j) <= 0 Or mod_impl(i, j) >= 0
div_impl_mod_impl_result : Axiom
Forall (i : int, j : int) : j /= 0 And (i < 0 Or j < 0) Implies
div_impl(i, j) ∗ j + mod_impl(i, j) = i
mod(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
if n2 /= 0 and range(i_typ)(mod(i_typ)(mod_impl(n1, n2))) then
ok_result(mod(i_typ)(mod_impl(n1, n2)))

else

fatal_result endif

)

% 5.6: C++’ s / operator
div(i_typ)
(n1_ex, n2_ex: ET[State, (range(i_typ))]) : ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
if n2 /= 0 And range(i_typ)(mod(i_typ)(div_impl(n1, n2))) then
ok_result(mod(i_typ)(div_impl(n1, n2)))

else

fatal_result endif

)

% Floatingpointdivisionmust be handledseparately.
% We use extendedreals, after checkingfor x / 0
% To do:
% div_float(typ: Cpp_Subtype(cv(floating_point?)))
% (n1_ex, n2_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =
% (
% n1_ex## lambda(n1 : (range(typ))):
% n2_ex## lambda(n2 : (range(typ))):
% If n2 /= 0 Andrange(typ)(mod(typ)(n1 / n2)) Then
% ok_result(mod(typ)(n1 / n2))
% Else
% fatal_result

167 B PVS Theory Sources

% Endif
% )
% Additiveoperators
% ====================
% 5.7
plus(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
If range(i_typ)(mod(i_typ)(n1 + n2)) Then
ok_result(mod(i_typ)(n1 + n2))

Else

fatal_result Endif

);

% To do: plus_float
% proof status:−)
% plus_ptr_TCC1: TCCObligation
% proof status:−)
% plus_ptr_TCC2: TCCObligation
% proof status:−)
% plus_ptr_TCC3: TCCObligation
% proof status:−)
% plus_ptr_TCC4: TCCObligation
% proof status:−)
% plus_ptr_TCC5: TCCObligation
% proof status:−)
% plus_ptr_TCC6: TCCObligation
% 5.7 pt 4 ff C++’ s + operatorfor pointers
plus_ptr(typ : Cpp_Subtype(cv(pointer?)), i_typ)
(p_ex: ET[State, (range_pointer(cv_base(typ)))],
n_ex: ET[State, (range(i_typ))]) :
ET[State, (range_pointer(cv_base(typ)))] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(typ)))) :
n_ex## lambda (n : (range(i_typ))) :
If not_null?(typ)(ptr_val) And
range_pointer(cv_base(typ))
(add(typ)(ptr_val, n ∗ size_of(typ(cv_base(typ))))) And
check_bounds(typ)
(add(typ)(ptr_val, n ∗ size_of(typ(cv_base(typ)))))

168

B.14 expressions.pvs

Then

ok_result(add(typ)(ptr_val, n ∗ size_of(typ(cv_base(typ)))))

Else

fatal_result Endif

)

% proof status:−)
% postinc_ptr_TCC1: TCCObligation
% proof status:−)
% postinc_ptr_TCC2: TCCObligation
% proof status:−)
% postinc_ptr_TCC3: TCCObligation
% proof status:−)
% postinc_ptr_TCC4: TCCObligation
% 5.2.6 pt 1: C++‘ s ++ operatorfor pointersto completeobject
% (equivalentto p = p + 1)
postinc_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) :
ET[State, (range_pointer(cv_base(typ)))] =

(

a_ex## lambda (a : Address):
plus_ptr(typ, uchar)(read_data(pm, dt_cv_pointer (typ))(a), ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))):
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(ptr_val)

)

% 5.3.2 pt 1: C++’ s ++. operatorfor pointers
% deferredto arithmeticexpressions
preinc_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) : ET[State, Address] =

(

a_ex## lambda (a : Address) :
plus_ptr(typ, uchar)(
read_data(pm, dt_cv_pointer (typ))(a),
ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))) :
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(a)

)

% proof status:−)
% subscript_TCC1: TCCObligation
% proof status:−)
% subscript_TCC2: TCCObligation
% proof status:−)
% subscript_TCC3: TCCObligation

169 B PVS Theory Sources

% proof status:−)
% subscript_TCC4: TCCObligation
% 5.2.1: Subscripting
% "The expressionE1[E2] is identical(by definitionto ∗((E1) + (E2))
% The check_boundsfunctionin plus and minusenforces the conditionsof
% clause 5.7 pt 5
% providedthe bounds−checkingpointermodel is implemented
subscript(pm, (typ : Cpp_Subtype(array?)), i_typ)
(a_ex, (n_ex: ET[State, (range(i_typ))])) : ET[State, Memory_Address] =

(

a_ex## Lambda (a : Address) :
deref(pm, pointer(typ(typ)))(
plus_ptr(pointer(typ(typ)), i_typ)(
read_data(pm, dt_cv_pointer (pointer(typ(typ))))(a),

n_ex) )

)

% 5.7 C++’ s − operator
minus(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
If range(i_typ)(mod(i_typ)(n1 − n2)) Then
ok_result(mod(i_typ)(n1 − n2))

Else

fatal_result Endif

)

% To do: minus_float
% 5.7 pt 4 ff C++’ s − operatorfor pointer− integral
minus_ptr(typ : Cpp_Subtype(cv(pointer?)), i_typ)
(p_ex: ET[State, (range_pointer(cv_base(typ)))],
n_ex: ET[State, (range(i_typ))]) :
ET[State, (range_pointer(cv_base(typ)))] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(typ)))) :
n_ex## lambda (n : (range(i_typ))) :
If not_null?(typ)(ptr_val) And
range_pointer(cv_base(typ))
(add(typ)(ptr_val, −n ∗ size_of(typ(cv_base(typ))))) And
check_bounds(typ)
(add(typ)(ptr_val, −n ∗ size_of(typ(cv_base(typ)))))

Then

ok_result(add(typ)(ptr_val, −n ∗ size_of(typ(cv_base(typ)))))

Else fatal_result

170

B.14 expressions.pvs

Endif )

% 5.2.6 pt 2: C++’ s .−− operatorfor pointersto completeobject
postdec_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) :
ET[State, (range_pointer(cv_base(typ)))] =

(

a_ex## lambda (a : Address):
minus_ptr(typ, uchar)(read_data(pm, dt_cv_pointer (typ))(a),
ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))):
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(ptr_val)

)

% 5.3.2 pt 1: C++’ s −−. operatorfor pointers
predec_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) :
ET[State, Address] =

(

a_ex## lambda (a : Address) :
minus_ptr(typ, uchar)(read_data(pm, dt_cv_pointer (typ))(a),
ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))):
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(a)

)

% proof status:−)
% ptr_to_nonzero_object_TCC1 : TCCObligation
% proof status:−)
% ptr_to_nonzero_object_TCC2 : TCCObligation
% proof status:−)
% ptr_to_nonzero_object_TCC3 : TCCObligation
% proof status:−)
ptr_to_nonzero_object : Lemma
Forall (typ : Cpp_Subtype(Lambda (p : (pointer?)) : Not void?(typ(p)) And
Not function?(typ(p)))) :
(array?(typ(cv_base(typ))) Implies size_of(typ(cv_base(typ))) > 0)

Implies

size_of(typ(cv_base(typ))) > 0
% 5.7 pt 6 ff C++’ s − operatorfor pointer− pointer
% "Whentwo pointersto elementsof the same arrayobject are substracted,
% ..."
% Thus, the pointershave to have the same type.
% proof status:−)
% minus_ptr_typ_is_Cpp_Type_TCC1 : TCCObligation

171 B PVS Theory Sources

% proof status:−)
minus_ptr_typ_is_Cpp_Type : Lemma
Forall (typ : Cpp_Subtype(cv(
Lambda (p : (pointer?)) : Not void?(typ(p)) And
Not function?(typ(p))))) :
Cpp_Type?(typ(cv_base(typ)))
% proof status:−)
% minus_ptr_ptr_TCC1 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC2 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC3 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC4 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC5 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC6 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC7 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC8 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC9 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC10 : TCCObligation
minus_ptr_ptr (typ : Cpp_Subtype(cv(
Lambda (p : (pointer?)) : Not void?(typ(p)) And
Not function?(typ(p)))))
(p_ex1, p_ex2: ET[State, (range_pointer(cv_base(typ)))]) :
ET[State, (range(int))] =

(

p_ex1## lambda (ptr_val1: (range_pointer(cv_base(typ)))) :
p_ex2## lambda (ptr_val2: (range_pointer(cv_base(typ)))) :
If (array?(typ(cv_base(typ))) Implies size_of(typ(cv_base(typ))) > 0) And
% otherwisewe substractpointerto incompletearrays
not_null?(typ)(ptr_val1) And
not_null?(typ)(ptr_val2) And
same_array(typ)(ptr_val1, ptr_val2) And
up?(address_of(typ)(ptr_val1)) And
up?(address_of(typ)(ptr_val2))

172

B.14 expressions.pvs

Then

Let difference = ndiv(offset(down(address_of(typ)(ptr_val1))) −
offset(down(address_of(typ)(ptr_val2))),
size_of(typ(cv_base(typ)))) In
If range(int)(difference) Then
ok_result(difference)

Else

fatal_result Endif

Else

fatal_result Endif

)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Shift Operators
% =================
% 5.8 pt 1: "The behavioris undefinedif the rightoperandis negative, or
% greaterthan or equal to the lengthin bits of the promotedleft operand."
% We do not (yet) model the latter.

%

% We do not model that the resultis implementation−definedif the first
% operandhas a signed type(for <<). The resultof >> is
% implementation−definedif the firstoperandhas a signed typeand a
% negativevalue; below we requirethe firstoperandto be nonnegative.
% 5.8 pt 1
% typeof result= typeof promotedleft operand(i.e., int, uint, long,
% ulong, longlong, ulonglong)
% undefinedif E2 < 0 or E2 > lengthin bits (max_value_bits )

% 5.8 pt 2
% E1 unsigned: mod(typ(E1))(E1 << n) otherwisefrom_byte(to_byte(E1) << n)

% 5.8 pt 3
% E1 unsigned: mod(typ(E1))(E1 >> n) if E1 >= 0 ; E1 < 0 => implementation
% definedvalue
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Rationaloperators
% ====================
cmp(i_typ, (R : PRED[[real, real]]))
(n1_ex, n2_ex: ET[State, (range(i_typ))]) : ET[State, bool] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):

173 B PVS Theory Sources

ok_result(R(n1, n2))

)

% To do: cmp ops for float
% 5.9 <
lt(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, <)(n1_ex, n2_ex)
% 5.9 >
gt(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, >)(n1_ex, n2_ex)
% 5.9 <=
le(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, <=)(n1_ex, n2_ex)
% 5.9 >=
ge(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, >=)(n1_ex, n2_ex)
% proof status:−)
% cmp_pointer_TCC1: TCCObligation
% proof status:−)
% cmp_pointer_TCC2: TCCObligation
% Rationaloperatorsfor pointers
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% 5.9
cmp_pointer(p_typ: Cpp_Subtype(cv(pointer?)), R : PRED[[real, real]],
cmp_null: bool)
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =

(

p1_ex## lambda (ptr_val1: (range_pointer(cv_base(p_typ)))) :
p2_ex## lambda (ptr_val2: (range_pointer(cv_base(p_typ)))) :
If not_null?(p_typ)(ptr_val1) And
not_null?(p_typ)(ptr_val2) Then
If same_array(p_typ)(ptr_val1, ptr_val2) And
up?(address_of(p_typ)(ptr_val1)) And
up?(address_of(p_typ)(ptr_val2))

Then

ok_result(R(offset(down(address_of(p_typ)(ptr_val1))),
offset(down(address_of(p_typ)(ptr_val2)))))

Else

fatal_result Endif

174

B.14 expressions.pvs

Else

ok_result(cmp_null)

Endif )

lt_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, <, false)(p1_ex, p2_ex)
gt_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, >, false)(p1_ex, p2_ex)
le_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, <=, true)(p1_ex, p2_ex)
ge_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, >=, true)(p1_ex, p2_ex)
% Rationaloperatorsfor pointersto members
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% 5.9 pt 2
% "If two pointerspointto nonstaticdata membersof the same
% object, or to subobjectsor arrayelementsof such members,
% recursively, the pointerto the laterdeclaredmembercompares
% greaterprovidedthe two membersare not separatedby an
% access−specifierlabeland providedtheirclass is not a union."
END ArithmeticExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.10: Equalityoperators

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
EqualityExpressions[State, Data : Type] : THEORY

BEGIN

IMPORTING ArithmeticExpressions
% C++’ s == operator
eq(l_ex, r_ex: ET[State, Data]) :
ET[State, bool] =

(

l_ex## lambda (l : Data) :

175 B PVS Theory Sources

r_ex## lambda (r : Data) :
ok_result((l = r))

);

% C++’ s != operator
not_equal(l_ex, r_ex: ET[State, Data]) :
ET[State, bool] =

(

l_ex## lambda (l : Data) :
r_ex## lambda (r : Data) :
ok_result((l /= r))

);

% to do: pointersto the same function
% to do: 5.10 pt 2 pointersto members
END EqualityExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.11: BitwiseANDoperator
% 5.12: BitwiseexclusiveORoperator
% 5.13: BitwiseinclusiveORoperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
BitwiseExpressions[State : Type] : THEORY

BEGIN

Importing Ok_Result_Rewrite , Cpp_Types
typ : Var Cpp_Subtype(cv(non_bool_integral_enum ?))
% 5.11. bit and &
bitand(typ)(n1_ex, n2_ex: ET[State, (range(typ))]) :
ET[State, (range(typ))] =

(

n1_ex## lambda (n1 : (range(typ))) :
n2_ex## lambda (n2 : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitand_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), Lambda (l : list[Byte]):
binary_and(l, to_byte(dt(typ))(n2, a)))
(to_byte(dt(typ))(n1, a)), a)

In

If up?(bitand_value) And range(typ)(down(bitand_value)) Then
ok_result(down(bitand_value))

Else

176

B.14 expressions.pvs

fatal_result Endif

)

% 5.12. bit xor ^
bitxor(typ)(n1_ex, n2_ex: ET[State, (range(typ))]) :
ET[State, (range(typ))] =

(

n1_ex## lambda (n1 : (range(typ))) :
n2_ex## lambda (n2 : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitxor_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), Lambda (l : list[Byte]):
binary_xor(l, to_byte(dt(typ))(n2, a)))
(to_byte(dt(typ))(n1, a)), a)

In

If up?(bitxor_value) And range(typ)(down(bitxor_value)) Then
ok_result(down(bitxor_value))

Else

fatal_result Endif

)

% 5.13. bit or |
bitor(typ)(n1_ex, n2_ex: ET[State, (range(typ))]) :
ET[State, (range(typ))] =

(

n1_ex## lambda (n1 : (range(typ))) :
n2_ex## lambda (n2 : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitor_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), Lambda (l : list[Byte]):
binary_or(l, to_byte(dt(typ))(n2, a)))
(to_byte(dt(typ))(n1, a)), a)

In

If up?(bitor_value) And range(typ)(down(bitor_value)) Then
ok_result(down(bitor_value))

Else

fatal_result Endif

)

END BitwiseExpressions

177 B PVS Theory Sources

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.14: LogicalANDoperator
% 5.15: LogicalORoperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% !! left−to−rightevaluationis guaranteedonlyfor base types!!
LogicalExpressions[State : Type] : THEORY

BEGIN

IMPORTING Ok_Result_Rewrite , Cpp_Types
l_ex, r_ex, ex : VAR [State −> ExprResult[State, bool]]
% 5.14
% C++’ s && operator
and_exp(l_ex, r_ex) : [State −> ExprResult[State, bool]] =

(

l_ex## lambda (l : bool):
if l then
r_ex## lambda (r : bool):
ok_result(l and r)

else

% 5.14.1: "Unlike&, && guaranteesleft−to−rightevaluation: the second
% operandis not evaluatedif the firstoperandis false."
ok_result(false)

endif )

% 5.15
% C++’ s || operator
or_exp(l_ex, r_ex) : [State −> ExprResult[State, bool]] =

(

l_ex## lambda (l : bool):
if l then
% 5.15.1: "Unlike|, || guaranteesleft−to−rightevaluation; moreover,
% the second operandis not evaluatedif the firstoperandevaluatesto
% true."
ok_result(true)

else

r_ex## lambda (r : bool):
ok_result(l or r)

endif )

END LogicalExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

178

B.14 expressions.pvs

% 5.16: Conditionaloperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ConditionalExpression[State, Data : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , Cpp_Types
pm : VAR Plain_Memory[State]
d_ex1: VAR [State −> ExprResult[State, Data]]
d_ex2: VAR [State −> ExprResult[State, Data]]
b_ex: VAR [State −> ExprResult[State, bool]]
% C++’ s b_ex? d_ex1: d_ex2
conditional_expr(b_ex, d_ex1, d_ex2) : [State −> ExprResult[State, Data]] =

(

b_ex## lambda (b : bool) :
If b Then

d_ex1 Else

d_ex2 Endif

);

% Not modelled:
% 5.16 pt 2: one but not both expressionsis voidand is a throwexpression
% 5.16 pt 2 − pt 6: restrictionson conversionsand restrictionson these.
End ConditionalExpression

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.17: Assignmentoperators

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
AssignmentExpressions[State : Type] : THEORY

BEGIN

IMPORTING ArithmeticExpressions, BitwiseExpressions
pm : VAR Plain_Memory[State]
AET : Type = [State −> ExprResult[State, Address]]
a_ex: Var AET
p_typ: Var Cpp_Subtype(v(pointer?))
i_typ: Var Cpp_Subtype(v(non_bool_integral_enum ?))
ci_typ: Var Cpp_Subtype(cv(non_bool_integral_enum ?))

179 B PVS Theory Sources

% 5.17.7: "The behaviorof an expressionof the form E1 op= E2 is equivalent
% to E1 = E1 op E2 exceptthat E1 is evaluatedonlyonce."
% the resultof the second expressioncan be of const(a_typ)
% proof status:−)
% assign_times_TCC1: TCCObligation
% C++’ s ∗= operator
assign_times(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
times(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do: assign_times_float
% C++’ s /= operator
assign_div(pm, i_typ)
(a_ex: AET, n_ex: ET[State, (range(i_typ))]) : ET[State, Address] =

(

a_ex## lambda (a : Address):
div(i_typ)
(read_data(pm, dt(i_typ))(a), n_ex) ## lambda (n : (range(i_typ))) :
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do:
% assign_div_float (pm, f_typ)
% (a_ex: AET, n_ex: ET[State, (range(f_typ))]) : ET[State, Address] =
% (
% a_ex## lambda(a : Address):
% div_float(f_typ)
% (read_data(pm, dt(f_typ))(a), n_ex) ## lambda(n : (range(f_typ))) :
% write_data(pm, dt(f_typ))(a, n) ##
% ok_result(a)
% )
% C++’ s %= operator
assign_mod(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
mod(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##

180

B.14 expressions.pvs

ok_result(a)

)

% C++’ s += operator
assign_plus(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
plus(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do: assign_plus_float
% proof status:−)
% assign_plus_ptr_TCC1 : TCCObligation
% proof status:−)
% assign_plus_ptr_TCC2 : TCCObligation
assign_plus_ptr (pm, p_typ, ci_typ)(a_ex: AET,
n_ex: ET[State, (range(ci_typ))]) : ET[State, Address] =

(

a_ex##
lambda (a : Address):
plus_ptr(p_typ, ci_typ)(read_data(pm, dt_cv_pointer (p_typ))(a), n_ex) ##
lambda (n : (range_pointer(cv_base(p_typ)))):
write_data(pm, dt_cv_pointer (p_typ))(a, n) ##
ok_result(a)

)

% C++’ s −= operator
assign_minus(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
minus(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do: assign_minus_float
assign_minus_ptr (pm, p_typ, ci_typ)(a_ex: AET,
n_ex: ET[State, (range(ci_typ))]) : ET[State, Address] =

(

a_ex## lambda (a : Address):
minus_ptr(p_typ, ci_typ)(read_data(pm, dt_cv_pointer (p_typ))(a), n_ex) ##
lambda (n : (range_pointer(cv_base(p_typ)))) :

181 B PVS Theory Sources

write_data(pm, dt_cv_pointer (p_typ))(a, n) ##
ok_result(a)

)

% C++’ s &= operator
assign_bitand(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
bitand(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))) :
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% C++’ s ^= operator
assign_bitxor(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
bitxor(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% C++’ s |= operator
assign_bitor(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
bitor(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

END AssignmentExpressions
AssignmentExpressions2[State, Data : Type] : Theory

Begin

Importing AssignmentExpressions
% Note that the assignmentoperatorsreturnan lvalue(i.e. an address).
% We define assignmentoperatorsonlyfor non class types.
% 5.17 pt 4 "Assignmentto objects of a class is definedby the copy
% assignmentoperator".
% Not modelled: 5.17 pt 8 restrictionson overlappingobjects

182

B.14 expressions.pvs

pm : VAR Plain_Memory[State]
AET : Type = [State −> ExprResult[State, Address]]
a_ex: Var AET
% C++’ s = operator
assign(pm, (idt : (interpreted_data_type ?[Data])))
(a_ex: AET, d_ex: ET[State, Data]) : ET[State, Address] =

(

a_ex## lambda (a : Address):
d_ex## lambda (d : Data) :
write_data(pm, idt)(a, d) ##
ok_result(a)

)

END AssignmentExpressions2

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.18: Commaoperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
CommaExpressions[State, Data1, Data2 : Type] : THEORY

BEGIN

IMPORTING Ok_Result_Rewrite
l_ex: VAR [State −> ExprResult[State, Data1]]
r_ex: VAR [State −> ExprResult[State, Data2]]
% C++’ s , operator
comma(l_ex, r_ex) : [State −> ExprResult[State, Data2]] =
(l_ex## r_ex)
END CommaExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Expressions: importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Expressions[State : Type] : THEORY

BEGIN

IMPORTING PrimaryExpressions,
% PostfixExpressions ,
% UnaryExpressions ,
PointerToMemberExpressions,

183 B PVS Theory Sources

% ArithmeticExpressions ,
EqualityExpressions,
% BitwiseExpressions ,
LogicalExpressions,
ConditionalExpression,
% AssignmentExpressions ,
AssignmentExpressions2,

CommaExpressions

END Expressions

B.15 graph.pvs

Graph_Util[T : Type] : Theory
% variousgeneralstuff needed for graphs

Begin

Importing More_List_Props , More_Function
% proof status:−)
every_nth: Lemma Forall(P : PRED[T], l : list[T]) :
every(P)(l) IFF (Forall(i : below(length(l))) : P(nth(l, i)))

% proof status:−)
% nth_append_left_TCC1 : TCCObligation
% proof status:−)
nth_append_left: Lemma
Forall(l1, l2 : list[T], n : nat) :
n < length(l1) Implies
nth(append(l1, l2), n) = nth(l1, n)
% proof status:−)
% nth_append_right_TCC1 : TCCObligation
% proof status:−)
nth_append_right: Lemma
Forall(l1, l2 : list[T], n : nat) :
n >= length(l1) And n < length(append(l1, l2)) Implies
nth(append(l1, l2), n) = nth(l2, n − length(l1))

% proof status:−)
list_pred_card: Lemma
Forall(l : list[T], P : PRED[T]) :
is_finite(P) And every(P)(l) And length(l) > card(P) Implies
Exists(n1, n2 : below(length(l))) :
Not n1 = n2 And
nth(l, n1) = nth(l, n2)

184

B.15 graph.pvs

% A path_listis a list withat least one element. A one
% elementpath is an (pointed) emptypath.
% Forthe transitiveclosurewe have of course to take path
% withat least two elements.
path_list?(l : list[T]) : bool = length(l) >= 1
% proof status:−)
% path_start_TCC1: TCCObligation
path_start(l : (path_list?)) : T = car(l)
% proof status:−)
% path_end_TCC1: TCCObligation
path_end(l : (path_list?)) : T = nth(l, length(l) −1)
% proof status:−)
% path_list_induction_TCC1 : TCCObligation
% proof status:−)
% path_list_induction_TCC2 : TCCObligation
% proof status:−)
path_list_induction : Lemma
Forall(p: [(path_list?) −> boolean]):
(Forall(t : T) : p(cons(t, null))) And
(Forall(t : T, tail : (path_list?)): p(tail) Implies p(cons(t, tail)))

Implies

Forall (l : (path_list?)): p(l)

concatable?(left, right : list[T]) : bool =
path_list?(left) And path_list?(right) And
path_end(left) = path_start(right)
% proof status:−)
% concat_path_TCC1: TCCObligation
% proof status:−)
% concat_path_TCC2: TCCObligation
concat_path(lr : (concatable?)) : (path_list?) =
append(Proj_1(lr), cdr(Proj_2(lr)))
% proof status:−)
length_concat_path: Lemma
Forall(l, r : list[T]) : concatable?(l, r) Implies
length(concat_path(l, r)) = length(l) + length(r) −1
End Graph_Util

185 B PVS Theory Sources

Subtype_stable[T : Type] : Theory

Begin

l : Var list[T]
P : Var PRED[T]
% proof status:−)
length_stable: Lemma
every(P)(l) Implies length[(P)](l) = length[T](l)
% proof status:−)
% nth_stable_TCC1: TCCObligation
% proof status:−)
nth_stable: Lemma Forall(n : below(length(l))) :
every(P)(l) Implies
nth[(P)](l, n) = nth[T](l,n)
End Subtype_stable

Graph_Relations[T : Type] : Theory

Begin

Importing Graph_Util
R : Var PRED[[T,T]]
transitive_closure(R) : PRED[[T, T]] = Lambda(x, y : T) :
Forall(Q : PRED[[T, T]]) : subset?(R, Q) And transitive?(Q) Implies
Q(x,y)
% proof status:−)
% trans_closure_char_TCC1 : TCCObligation
% proof status:−)
% trans_closure_char_TCC2 : TCCObligation
% proof status:−)
% trans_closure_char_TCC3 : TCCObligation
% proof status:−)
trans_closure_char: Lemma
Forall(x, y : T) :
transitive_closure(R)(x,y) IFF
Exists(l : list[T]) :
length(l) >= 2 And
path_start(l) = x And path_end(l) = y and
Forall(i : below(length(l) −1)) : R(nth(l, i), nth(l, i+1))
End Graph_Relations

Graph[T : Type] : Theory

186

B.15 graph.pvs

Begin

Importing Graph_Relations, Subtype_stable
graph_type: Type = [#
nodes : PRED[T],
edges : PRED[[(nodes), (nodes)]]

#]

g : Var graph_type
% proof status:−)
% path?_TCC1: TCCObligation
% proof status:−)
% path?_TCC2: TCCObligation
% proof status:−)
% path?_TCC3: TCCObligation
% proof status:−)
% path?_TCC4: TCCObligation
path?(g)(l : (path_list?[T])) : bool =
(Forall(i : below(length(l))) : g‘nodes(nth(l, i))) And
(Forall(i : below(length(l) −1)) : g‘edges(nth(l,i), nth(l, i+1)))
% proof status:−)
nodes_path_start: Lemma
Forall(p : (path?(g))) : g‘nodes(path_start(p))
% proof status:−)
nodes_path_end: Lemma
Forall(p : (path?(g))) : g‘nodes(path_end(p))
% proof status:−)
% path_head_TCC1: TCCObligation
% proof status:−)
path_head: Lemma
Forall(p : (path?(g)), n : upto(length(p))) :
n >= 1 Implies
path?(g)(head(p, n))
% proof status:−)
% path_tail_TCC1: TCCObligation
% proof status:−)
path_tail: Lemma
Forall(p : (path?(g)), n : upto(length(p))) :
length(p) − n >= 1 Implies
path?(g)(tail(p, n))

187 B PVS Theory Sources

% proof status:−)
% path_cdr_TCC1: TCCObligation
% proof status:−)
path_cdr: Lemma
Forall(p : (path?(g))) :
path_list?[T](cdr(p)) Implies path?(g)(cdr(p))

% proof status:−)
path_concat_path: Lemma
Forall(p1, p2 : (path?(g))) : concatable?(p1, p2) Implies
path?(g)(concat_path(p1, p2))

cycle_free?(g) : bool =
Forall(x : T) : g‘nodes(x) Implies
Not transitive_closure(g‘edges)(x, x)

% proof status:−)
trans_closure_char_graph : Lemma
Forall(x, y : (g‘nodes)) :
transitive_closure(g‘edges)(x,y) IFF
Exists(l : (path?(g))) :
length(l) >= 2 And
path_start(l) = x And path_end(l) = y

% proof status:−)
path_cycle_free: Lemma
cycle_free?(g) IFF
Forall(l : (path?(g)), i1, i2 : below(length(l))) :
nth(l, i1) = nth(l, i2) Implies i1 = i2
% proof status:−)
different_nodes_on_edge : Lemma
Forall(x, y : (g‘nodes)) :
cycle_free?(g) And
g‘edges(x, y) Implies
Not x = y
% set of roots of a graph
roots(g) : PRED[(g‘nodes)] =
{y : (g‘nodes) | Forall(x : (g‘nodes)) : Not g‘edges(x,y) }

% A tree is cycle free and each node has at most one predecessor.
tree?(g) : bool =
cycle_free?(g) And
Forall(x, y, z : (g‘nodes)) :
g‘edges(x,z) And g‘edges(y,z) Implies x = y

188

B.15 graph.pvs

% In a tree there is onlyone path going up from a certainnode.
% So any two path endingin the same node onlydifferin theirlength.
% proof status:−)
tree_path: Lemma
Forall(p1, p2 : (path?(g))) :
tree?(g) And
path_end(p1) = path_end(p2) And
length(p1) = length(p2) Implies
p1 = p2
% a graphis finiteif its set of nodes is
finite?(g) : bool = is_finite(g‘nodes)
finite_tree?(g) : bool = finite?(g) and tree?(g)
% proof status:−)
% root_path_TCC1: TCCObligation
root_path(g : graph_type, n : (g‘nodes)) : PRED[(path?(g))] =
Lambda(p : (path?(g))) :
roots(g)(path_start(p)) And path_end(p) = n
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% singletonroot_path

%

% In finitetrees there is for everynode preciselyone
% path upwardsto a root (root_path). Thisis provedin the following
% and then the functionpath_to_rootis defined(via selectionout of
% a singleton).

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% path_length_bound_TCC1 : TCCObligation
% proof status:−)
path_length_bound: Lemma
finite?(g) and cycle_free?(g) Implies
Forall(p : (path?(g))) : length(p) <= card(g‘nodes)
% proof status:−)
non_root_path: Lemma
Forall(n : (g‘nodes)) : roots(g)(n) OR
Exists(p : (path?(g))) : length(p) = 2 And path_end(p) = n
% proof status:−)
% non_root_path_extend_TCC1 : TCCObligation
% proof status:−)
non_root_path_extend : Lemma

189 B PVS Theory Sources

Forall(p : (path?(g))) : roots(g)(path_start(p)) OR
Exists(q : (path?(g))) :
length(q) = length(p) + 1 And
path_end(q) = path_end(p)
% proof status:−)
tree_path_to_root : Lemma
finite_tree?(g) Implies
Forall(n : (g‘nodes)) :
Exists(p : (path?(g))) : root_path(g, n)(p)
% proof status:−)
tree_unique_path_to_root : Lemma
Forall(n : (g‘nodes), p1, p2 : (path?(g))) :
tree?(g) And root_path(g, n)(p1) And root_path(g, n)(p2)

Implies

p1 = p2
% proof status:−)
root_path_singleton: Lemma Forall(n: (g‘nodes)) :
finite_tree?(g) Implies
singleton?(root_path(g, n));
% proof status:−)
% path_to_root_TCC1: TCCObligation
path_to_root (g : (finite_tree?), n : (g‘nodes)) : (root_path(g, n)) =
the(root_path(g, n))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Path factoring. Everytwo path that startwiththe same node
% have the same initialsequence.

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% path_factor_TCC1: TCCObligation
% proof status:−)
% path_factor_TCC2: TCCObligation
% proof status:−)
% path_factor_TCC3: TCCObligation
% proof status:−)
% path_factor_TCC4: TCCObligation
% proof status:−)
path_factor: Lemma Forall (p1, p2 : (path?(g))) :
path_start(p1) = path_start(p2) And

190

B.15 graph.pvs

(Exists(n : nat) : n < length(p1) And n < length(p2) And
NOT nth(p1, n) = nth(p2, n))

Implies

Exists(q, p1t, p2t : (path?(g))) :
concatable?(q, p1t) And concatable?(q, p2t) And
length(p1t) >= 2 And length(p2t) >= 2 And
p1 = concat_path(q, p1t) And
p2 = concat_path(q, p2t) And
nth(p1t, 0) = nth(p2t, 0) And
NOT nth(p1t, 1) = nth(p2t, 1)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Node case distinction. Two nodes n1 and n2 can be relatedin the
% followingway:

%

% − theyare equal
% − n1 layson the root path of n2
% − n2 layson the root path of n1
% − the two root path lead to differentroots
% (in this case the two root path are totallydistinct)
% − the two root path meet at some node n3
% (in this case the two root path go to the same root)

%

% Thisdistinctionis completeand can be used to provean arbitrary
% predicatefor all pairsof nodes.

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% node_pair_distinction_TCC1 : TCCObligation
% proof status:−)
node_pair_distinction: Lemma
Forall(P : PRED[[(g‘nodes), (g‘nodes)]]) :
finite_tree?(g) And
(Forall(n : (g‘nodes)) : P(n, n))

And

(Forall(n1, n2 : (g‘nodes), p : (path?(g))) :
NOT n1 = n2 And
path_start(p) = n2 And path_end(p) = n1 And length(p) >= 2 Implies
P(n1, n2))

And

(Forall(n1, n2 : (g‘nodes), p : (path?(g))) :
NOT n1 = n2 And
path_start(p) = n1 And path_end(p) = n2 And length(p) >= 2 Implies
P(n1, n2))

And

(Forall(n1, n2 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And root_path(g, n1)(p1) And root_path(g, n2)(p2) And
NOT path_start(p1) = path_start(p2) Implies

191 B PVS Theory Sources

P(n1, n2))

And

(Forall(n1, n2, n3 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And NOT n1 = n3 And NOT n2 = n3 And
g‘edges(n3, path_start(p1)) And g‘edges(n3, path_start(p2)) And
path_end(p1) = n1 And path_end(p2) = n2 And
NOT path_start(p1) = path_start(p2) Implies
P(n1, n2))

Implies

Forall(n1, n2 : (g‘nodes)) : P(n1, n2)

% Variantfor symmetricP, whichleavesout the case of
% − n2 layson the root path of n1
% proof status:−)
% symmetric_node_pair_distinction_TCC1 : TCCObligation
% proof status:−)
symmetric_node_pair_distinction : Lemma
Forall(P : PRED[[(g‘nodes), (g‘nodes)]]) :
finite_tree?(g) And
symmetric?(P) And
(Forall(n : (g‘nodes)) : P(n, n))

And

(Forall(n1, n2 : (g‘nodes), p : (path?(g))) :
NOT n1 = n2 And
path_start(p) = n2 And path_end(p) = n1 And length(p) >= 2 Implies
P(n1, n2))

And

(Forall(n1, n2 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And root_path(g, n1)(p1) And root_path(g, n2)(p2) And
NOT path_start(p1) = path_start(p2) Implies
P(n1, n2))

And

(Forall(n1, n2, n3 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And NOT n1 = n3 And NOT n2 = n3 And
g‘edges(n3, path_start(p1)) And g‘edges(n3, path_start(p2)) And
path_end(p1) = n1 And path_end(p2) = n2 And
NOT path_start(p1) = path_start(p2) Implies
P(n1, n2))

Implies

Forall(n1, n2 : (g‘nodes)) : P(n1, n2)
End Graph

B.16 hoare.pvs

% $Id: hoare.pvs,v 1.8.8.1.2.2 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

192

B.16 hoare.pvs

%

% Hoare logics for our shallowC++ embedding.
Hoare[State: Type] : THEORY

BEGIN

IMPORTING State_Transformer
P : VAR PRED[State]
c : VAR [State −> StmtResult[State]]
C : VAR [StmtResult[State] −> StmtResult[State]]
Q : VAR PRED[State]
R : Var PRED[State]
% CurrentlyHoare tripleswithliftedstatements
% {P} C {Q}
% are not used. Theymay be useful to considerpartialprogramson
% intermediatestates (i.e. to verifyprogramscompositionally), but
% otherwise, since programsare simplestatementsoperatingon states
% (ratherthan on StmtResults), onlyHoare triples
% {P} c {Q}
% are needed.
s : VAR State
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Partialcorrectness: if the resultis OK, it must satisfythe postcondition

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% valid_TCC1: TCCObligation
% proof status:−)
% valid_TCC2: TCCObligation
valid(P, c, Q) : bool =
forall s: P(s) and OK?(c(s)) implies Q(state(c(s)))
% proved− complete
% valid_TCC1
valid(P, C, Q) : bool =
forall s: P(s) and OK?(C(OK(s))) implies Q(state(C(OK(s))))
% proved− complete
% valid_TCC2
% proof status:−)
valid_and: Lemma
valid(P, c, Q) And valid(P, c, R)

193 B PVS Theory Sources

Implies

valid(P, c, Lambda (s : State) : Q(s) And R(s))
% proof status:−)
valid_implied: Lemma
valid(P, c, Q) And valid(P, c, Lambda (s : State) : Q(s) Implies R(s))

Implies

valid(P, c, Lambda (s : State) : Q(s) And R(s))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Total correctness: resultmust be OK and satisfythe postcondition

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Valid(P, c, Q) : bool =
forall s: P(s) implies OK?(c(s)) and Q(state(c(s)))
Valid(P, C, Q) : bool =
forall s: P(s) implies OK?(C(OK(s))) and Q(state(C(OK(s))))
% proof status:−)
Valid_and: Lemma
Valid(P, c, Q) And Valid(P, c, R)

Implies

Valid(P, c, Lambda (s : State) : Q(s) And R(s))

END Hoare

B.17 linear_memory.pvs

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Splitrange into list of alignedchunks

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% To do: move to prelude
List_Split: Theory

Begin

Importing IA32, More_List_Props , Alignment
% split
% −−−−−−−
% | a a1 a2 a3 |
% | −−|−−−−−−|−−−−−−|−−− |
% =>
% (a, −−), (a1, −−−−−−), (a2, −−−−−−), (a3, −−−), null

194

B.17 linear_memory.pvs

% proof status:−)
% split_TCC1: TCCObligation
% proof status:−)
% split_TCC2: TCCObligation
split(size : nat, a : Address, bl : list[Byte]) :
Recursive list[[Address, list[Byte]]] =
Let e2size = expt(2, size) In
If null?(bl) Then null Else
If a + length(bl) <= floor(e2size)(a) + e2size Then
cons( (a, bl), null)

Else

Let delta = rem(e2size)(offset(a)) In
cons( (a, head(bl, e2size − delta)),
split(size, floor(e2size)(a) + e2size, tail(bl, e2size − delta)))

Endif Endif

Measure length(bl)
% some correctnesslemmas
% proof status:−)
split_pair_cross_size : Lemma
Forall (size : nat, a1 : Address, bl1 : list[Byte], n : nat) :
Let e2size = expt(2, size) In
n = length(bl1) Implies
every(Lambda(a2 : Address, bl2 : list[Byte]) :
rem(e2size)(offset(a2)) + length(bl2) <= e2size
)(split(size, a1, bl1))
% proof status:−)
split_pair_concat: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :
Let e2size = expt(2, size) In
n = length(bl) Implies
reduce(null,
Lambda (e : [Address, list[Byte]], tail : list[Byte]) :
Let head = e‘2 In
append(head, tail))(split(size, a, bl)) = bl
% proof status:−)
split_range: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :
Let e2size = expt(2, size) In
n = length(bl) Implies
every(Lambda (a2 : Address, bl2 : list[Byte]) :
a <= a2 And a2 + length(bl2) <= a + n)(split(size, a, bl))
% proof status:−)
split_no_null: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :

195 B PVS Theory Sources

Let e2size = expt(2, size) In
n = length(bl) And cons?(bl) Implies
every(Lambda (a2 : Address, bl2 : list[Byte]) : cons?(bl2))
(split(size, a, bl))
% proof status:−)
split_null: Lemma
Forall (size : nat, a : Address) : split(size, a, null) = null
% proof status:−)
% split_type_TCC1: TCCObligation
% proof status:−)
% split_type_TCC2: TCCObligation
% proof status:−)
split_type: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :
reg_base(min_linear)(type_of(a)) <= a And
a + length(bl) <= reg_size(max_linear)(type_of(a))

Implies

every(LAMBDA (t: [Address, list[Byte]]):
type_of(t‘1) = type_of(a) And
reg_base(min_linear)(type_of(a)) <= t‘1 And
t‘1 < reg_size(max_linear)(type_of(a)))
(split(min_page, a, bl))
End List_Split
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% LinearMemory

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% to do: avoidpaging_data_type
Linear_Memory[Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm : Plain_Memory] : Theory

Begin

Importing Paging_Datatype,

PDBR_Datatype

,

Segment_Reg_Datatype

,

Address_Datatype

Importing Abstract_Read_Write_Plain ,

List_Split

Linear_memory: Type = Physical_memory

196

B.17 linear_memory.pvs

s : Var Linear_memory
a : Var Address
access : Var Memory_access
b : Var Byte
size : Var nat
% ProtectedInterface
% =====================
bits_per_level: nat = 10
pdir_lvl: nat = 0
ptab_lvl: nat = 1
% proof status:−)
% xlat_idx_TCC1: TCCObligation
% proof status:−)
% xlat_idx_TCC2: TCCObligation
% computepe address/ offset
xlat_idx(lvl : Level, base, addr : Memory_Address_4G ) : Address =
base + shift_bits_left (cut_bits(offset(addr), bus_width− (lvl + 1) ∗
bits_per_level , bits_per_level ), pe_size)
% proof status:−)
% xlat_idx_pe_aligned_TCC1 : TCCObligation
% proof status:−)
% xlat_idx_pe_aligned_TCC2 : TCCObligation
% proof status:−)
xlat_idx_pe_aligned : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bits_per_level+ pe_size)(offset(base))

Implies

aligned?(pe_size)(offset(xlat_idx(lvl, base, addr)))
% proof status:−)
xlat_idx_memory_address : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bits_per_level+ pe_size)(offset(base))

Implies

xlat_idx(lvl, base, addr) < max_linear
% proof status:−)
xlat_idx_memory_address2 : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bits_per_level+ pe_size)(offset(base))

Implies

0 <= offset(xlat_idx(lvl, base, addr))

197 B PVS Theory Sources

xlat_ofs(lvl : Level, base, addr : Memory_Address_4G ) : Address =
base + cut_bits(offset(addr), 0, bus_width− (lvl + 1) ∗ bits_per_level )
% proof status:−)
xlat_ofs_memory_address : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bus_width− (lvl + 1) ∗ bits_per_level )(offset(base))

Implies

xlat_ofs(lvl, base, addr) < max_linear
% proof status:−)
xlat_ofs_memory_address2 : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bus_width− (lvl + 1) ∗ bits_per_level )(offset(base))

Implies

0 <= offset(xlat_ofs(lvl, base, addr))
% proof status:−)
% raise_fault_TCC1: TCCObligation
% raise fault
raise_fault(priv : Memory_privilege, access : Memory_access, present : bool,
pfa : Memory_Address_4G ) :
[Physical_memory−> ExprResult[Physical_memory, [bool, Address]]] =
write_data(pm, address_data_type )(CR2, pfa) ##
exception_result(Page_fault(
(# reserved_bit_violation:= false, % writingreservedbits is fatal
privilege := priv,
access := add(Read, access),
present := present

#)))

% proof status:−)
% translate_TCC1: TCCObligation
% single levelof the translation
translate(lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege)
: [Physical_memory−> ExprResult[Physical_memory, [bool, Address]]] =
Let pe_addr= xlat_idx(lvl, base, addr) In
(read_data(pm, paging_data_type (lvl))(pe_addr) ##
Lambda (pe : (range_pt(lvl))) :
If paging_type?(lvl, pe) Then
If present?(pe) Then
If accessible?(pe, access) And privileged?(pe, priv) Then
write_data(pm, paging_data_type (lvl))(pe_addr,
set_reference(pe, access)) ##
ok_result( (is_leaf?(pe), base(pe)) )

Else

raise_fault(priv, access, true, addr)

Endif

198

B.17 linear_memory.pvs

Else

raise_fault(priv, access, false, addr)

Endif Else

fatal_result

Endif)
% proof status:−)
translate_memory_address: Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

data(translate(lvl, base, addr, access, priv)(s))‘2 < max_linear
% proof status:−)
translate_memory_address2: Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

0 <= offset(data(translate(lvl, base, addr, access, priv)(s))‘2)

% proof status:−)
% translate_result_leaf_TCC1 : TCCObligation
% proof status:−)
% translate_result_leaf_TCC2 : TCCObligation
% !!! translate_result_leaf_TCC1 : originallong runningproof is nondefault!!
% proof status:−)
translate_result_leaf: Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s)) And
data(translate(lvl, base, addr, access, priv)(s))‘1

Implies

aligned?(bus_width− bits_per_level∗ (lvl + 1))
(offset(data(translate(lvl, base, addr, access, priv)(s))‘2))
% proof status:−)
% translate_result_no_leaf_TCC1 : TCCObligation
% proof status:−)
translate_result_no_leaf : Lemma

199 B PVS Theory Sources

Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s)) And
Not data(translate(lvl, base, addr, access, priv)(s))‘1

Implies

aligned?(bits_per_level+ pe_size)
(offset(data(translate(lvl, base, addr, access, priv)(s))‘2))

% proof status:−)
% linear_resolve_TCC1: TCCObligation
% proof status:−)
% linear_resolve_TCC2: TCCObligation
% proof status:−)
% linear_resolve_TCC3: TCCObligation
% proof status:−)
% linear_resolve_TCC4: TCCObligation
% proof status:−)
% linear_resolve_TCC5: TCCObligation
% proof status:−)
% linear_resolve_TCC6: TCCObligation
% proof status:−)
% linear_resolve_TCC7: TCCObligation
% proof status:−)
% linear_resolve_TCC8: TCCObligation
% translate
linear_resolve(addr : Memory_Address_4G , access : Memory_access)
: [Linear_memory−> ExprResult[Linear_memory, Address]] =
% 1. get currentprivilegelevelfrom cs
(read_data(pm, segment_reg_data_type )(CS) ##
Lambda (cs : Segment_Reg_type ) :
Let priv = segment_to_priv (cs) In
% 2. read PDBR
(read_data(pm, pdbr_data_type )(PDBR) ##
Lambda (pdbr : Pdbr_type) :
% 3. PDElookup
Let lvl = pdir_lvlIn
(translate(lvl, pdbr‘base_addr, addr, access, priv) ##
Lambda (leaf : bool,
base : {b : Memory_Address_4G|
If leaf Then
aligned?(bus_width− bits_per_level∗ (lvl + 1))(offset(b))

200

B.17 linear_memory.pvs

Else

aligned?(bits_per_level+ pe_size)(offset(b))
Endif}) :
If leaf Then
ok_result(xlat_ofs(lvl, base, addr))

Else

Let lvl = ptab_lvlIn
(translate(lvl, base, addr, access, priv) ##
Lambda (leaf : bool,
base : Memory_Address_4G ) :
ok_result(xlat_ofs(lvl, base, addr)))
Endif)))
% proof status:−)
linear_resolve_memory_address : Judgement
linear_resolve(addr : Memory_Address_4G , access : Memory_access) Has_Type
[Linear_memory−> ExprResult[Linear_memory, Memory_Address_4G ]]
% side effect helpers
linear_read_side_effect_in_page (a : Memory_Address_4G , bl : list[Byte])(s) :
ExprResult[Linear_memory, list[Byte]] =
(linear_resolve(a, Read) ##
Lambda(pa : Memory_Address_4G )(ns : Linear_memory) :
memory_read_side_effect (pm‘mem)(pa, bl, true)(s))(s)
linear_write_side_effect_in_page (a : Memory_Address_4G , bl : list[Byte])(s) :
ExprResult[Linear_memory, list[Byte]] =
(linear_resolve(a, Write) ##
Lambda(pa : Memory_Address_4G )(ns : Linear_memory) :
memory_write_side_effect (pm‘mem)(pa, bl, true)(s))(s)
apply_side_effects (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]])(s) :
ExprResult[Linear_memory, list[Byte]] =
reduce(ok_result(null),
Lambda (e : [Memory_Address_4G , list[Byte]],
r : [Linear_memory−> ExprResult[Linear_memory, list[Byte]]]) :
(r ##
Lambda (tail : list[Byte]) :
(f(e) ##
Lambda (head : list[Byte]) : ok_result(append(head, tail))))
)(l)(s)
% Note that the elementwiththe highestaddressis evaluatedfirst
% PublicInterface
% ==================
% proof status:−)
% linear_read_TCC1: TCCObligation
% proof status:−)

B PVS Theory Sources

% linear_read_TCC2: TCCObligation
% proof status:−)
% linear_read_TCC3: TCCObligation
% read & write
linear_read(a) : [Linear_memory−> ExprResult[Linear_memory, Byte]] =
If in_memory(min_linear, max_linear)(a) Then
If Mem?(type_of(a)) Then
linear_resolve(a, Read) ##
Lambda (pa : Address) :
memory_read(pm‘mem)(pa)

Else

memory_read(pm‘mem)(a)

Endif Else

fatal_result Endif

linear_write(a, b) : [Linear_memory−> ExprResult[Linear_memory, Unit]] =
If in_memory(min_linear, max_linear)(a) Then
If Mem?(type_of(a)) Then
linear_resolve(a, Write) ##
Lambda (pa : Address) :
memory_write(pm‘mem)(pa, b)

Else

memory_write(pm‘mem)(a, b)

Endif Else

fatal_result Endif

% proof status:−)
% linear_read_side_effect_TCC1 : TCCObligation
% LinearSide Effects
linear_read_side_effect (a : Address, bl : list[Byte], cp : bool

)(s)

: ExprResult[Linear_memory, list[Byte]] =

If null?(bl) Or (reg_base(min_linear)(type_of(a)) <= a And a + length(bl) <= reg_size(max_linear)(type_of(a))) Then

If Mem?(type_of(a)) Then % splitlist in page containedlists apply_side_effects (split(min_page, a, bl),

linear_read_side_effect_in_page )(s)

Else

memory_read_side_effect (pm‘mem)(a, bl, cp)(s) Endif

Else

Fatal Endif

202

B.18 memory.pvs

linear_write_side_effect (a : Address, bl : list[Byte], cp : bool)(s)

: ExprResult[Linear_memory, list[Byte]] =

If null?(bl) Or (reg_base(min_linear)(type_of(a)) <= a And a + length(bl) <= reg_size(max_linear)(type_of(a))) Then

If Mem?(type_of(a)) Then % splitlist in page containedlists apply_side_effects (split(min_page, a, bl),

linear_write_side_effect_in_page )(s)

Else

memory_write_side_effect (pm‘mem)(a, bl, cp)(s) Endif

Else

Fatal Endif

% The memorystruct linear_pm: Memory_struct[Linear_memory] = (#

memory_read:= linear_read, memory_write:= linear_write,

memory_read_side_effect := linear_read_side_effect , memory_write_side_effect := linear_write_side_effect

#)

END Linear_Memory

B.18 memory.pvs

% $Id: memory.pvs,v 1.55.6.1.4.3 2008/05/14 14:24:59 tews Exp$

Address_Util: Theory Begin

IMPORTING IA32 IMPORTING More_Sets_Lemmas% for disjoint_mono Importing More_List_Props

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % addressblocks % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% the set of addressesaddr<= a < addr+ size address_block(addr : Address, size : nat) : PRED[Address] =

Lambda(a : Address) :

type_of(addr) = type_of(a) And offset(addr) <= offset(a) AND offset(a) < offset(addr) + size

% a lemmaneeded in the inductionbelow

203 B PVS Theory Sources

% proof status:−) address_block_subset_1 : Lemma Forall(addr : Address, size : nat) :

subset?(address_block(addr + 1, size), address_block(addr, 1 + size))

% proof status:−) address_block_subset_2 : Lemma

Forall(addresses : PRED[Address], addr : Address, size : nat) :

subset?(address_block(addr, size + 1), addresses) Implies subset?(address_block(addr + 1, size), addresses)

blocks_disjoint?(addr1 : Address, size1 : nat,

addr2 : Address, size2 : nat) : bool =

type_of(addr1) /= type_of(addr2) Or

addr1 + size1 <= addr2 OR addr2 + size2 <= addr1

% proof status:−) blocks_disjoint_disjoint: Lemma

Forall (addr1, addr2 : Address, size1, size2 : nat) :

size1 > 0 And size2 > 0 Implies

blocks_disjoint?(addr1, size1, addr2, size2) = disjoint?(address_block(addr1, size1), address_block(addr2, size2))

% proof status:−) blocks_disjoint_symmetric: Lemma

Forall (addr1, addr2 : Address, size1, size2 : nat) :

blocks_disjoint?(addr1, size1, addr2, size2) = blocks_disjoint?(addr2, size2, addr1, size1)

% proof status:−) blocks_in_larger_set : Lemma

Forall (addr1, addr2 : Address, size1, size2 : nat,

addresses : PRED[Address]) :

subset?(address_block(addr1, size1), addresses) And subset?(address_block(addr2, size2), addresses) And blocks_disjoint?(addr1, size1, addr2, size2)

Implies

subset?(address_block(addr2, size2), difference(addresses, address_block(addr1, size1)))

blocks_pairwise_disjoint (blocks : list[[Address, posnat]]) : bool =

Forall(addr_1, addr_2: Address, size_1, size_2: posnat) :

member((addr_1, size_1), blocks) And member((addr_2, size_2), list_remove((addr_1, size_1), blocks))

Implies blocks_disjoint?(addr_1, size_1, addr_2, size_2)

% proof status:−) blocks_pairwise_disjoint_add : Lemma

204

B.18 memory.pvs

Forall(addr : Address, size : posnat, blocks : list[[Address, posnat]]) : blocks_pairwise_disjoint (blocks) And (Forall(oaddr : Address, osize : posnat) :

member((oaddr, osize), blocks) Implies

blocks_disjoint?(addr, size, oaddr, osize))

Implies blocks_pairwise_disjoint (cons((addr, size), blocks))

% proof status:−) blocks_pairwise_disjoint_remove : Lemma

Forall(addr : Address, size : posnat, blocks : list[[Address, posnat]]) :

blocks_pairwise_disjoint (blocks) Implies blocks_pairwise_disjoint (list_remove((addr, size), blocks))

block_is_free (block : PRED[Address],

alloc_points: list[[Address, posnat]]) : bool =

Forall(addr : Address, size : posnat) :

member((addr, size), alloc_points) Implies disjoint?(block, address_block(addr, size))

% proof status:−) subset_block_is_free : Lemma

Forall(b1, b2 : PRED[Address], alloc_points: list[[Address, posnat]]) : subset?(b1, b2) And block_is_free (b2, alloc_points) Implies

block_is_free (b1, alloc_points)

% proof status:−) block_is_free_add : Lemma

Forall(block : PRED[Address], alloc_points: list[[Address, posnat]],

addr : Address, size : posnat) :

block_is_free (block, alloc_points) And disjoint?(block, address_block(addr, size))

Implies block_is_free (block, cons((addr, size), alloc_points))

End Address_Util

Memory[State : Type] : Theory % % memoryis a common memoryabstraction % it comes withread and writefunctions % % this theorydefinesthe notionof memoryand % some utilityfunctions/lemmas % Begin

IMPORTING Unit, Address_Util, State_Transformer

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

205 B PVS Theory Sources

% % memorydefinition % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Memory_struct: Type =

[#

memory_read: [Address −>

[State −> ExprResult[State, Byte]]],

memory_write: [Address, Byte −> [State −> ExprResult[State, Unit]]],

memory_read_side_effect : [Address, list[Byte], bool −>

[State −> ExprResult[State, list[Byte]]]],

memory_write_side_effect : [Address, list[Byte], bool −>

[State −> ExprResult[State, list[Byte]]]]

#]

s : Var State pm : Var Memory_struct bl : Var list[Byte] addr : Var Address size : Var nat

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % write_list % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−) % memory_write_list_nse_TCC1 : TCCObligation

% proof status:−) % memory_write_list_nse_TCC2 : TCCObligation

% side effect free list write memory_write_list_nse (pm)(addr, bl) : Recursive

[State −> ExprResult[State, Unit]] =

Cases bl of null : ok_result(unit), cons(b, rl) :

(memory_write(pm)(addr, b) ##

memory_write_list_nse (pm)(addr + 1, cdr(bl))) EndCases Measure length(bl)

% applywriteside effect before registeris modified memory_write_list (pm)(addr, bl) : [State −> ExprResult[State, Unit]] =

memory_write_side_effect (pm)(addr, bl, false) ## Lambda (bl1 : list[Byte]) :

206

B.18 memory.pvs

memory_write_list_nse (pm)(addr, bl1)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % read_list % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−) % memory_read_list_nse_TCC1 : TCCObligation

% proof status:−) % memory_read_list_nse_TCC2 : TCCObligation

% side effect free list read memory_read_list_nse (pm)(addr, size) : Recursive

[State −> ExprResult[State, list[Byte]]] =

If size > 0 Then

memory_read(pm)(addr) ##

Lambda (b : Byte) :

(memory_read_list_nse (pm)(addr + 1, size − 1) ## Lambda (res_list: list[Byte]) : ok_result(cons(b, res_list)))

Else

ok_result(null) Endif Measure size

% applyside effect on read content memory_read_list (pm)(addr, size) : [State −> ExprResult[State, list[Byte]]] =

memory_read_list_nse (pm)(addr, size) ##

Lambda (bl1 : list[Byte]) :

memory_read_side_effect (pm)(addr, bl1, false)

% proof status:−) memory_read_list_ok_length : Lemma

OK?(memory_read_list_nse (pm)(addr, size)(s)) IMPLIES

length(data(memory_read_list_nse (pm)(addr, size)(s))) = size

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % memory_readtransformers(sets of memory_read’s) % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

addresses : Var PRED[Address]

% the set of state transformersthat read at addresses

207 B PVS Theory Sources

memory_read_transformers (pm, addresses) :

PRED[[State −> SuperResult[State]]] =

Lambda(q : [State −> SuperResult[State]]) :

Exists(a : Address) : addresses(a) AND q = expr_2_super (memory_read(pm)(a))

% the obviousrewritelemma % proof status:−) memory_read_transformers_memory_read : Lemma Forall(addr : Address) :

addresses(addr) IMPLIES

memory_read_transformers (pm, addresses)

(expr_2_super (memory_read(pm)(addr)))

% Monotonicity % proof status:−) memory_read_transformers_mono : Lemma

Forall(addresses_1, addresses_2: PRED[Address]) :

subset?(addresses_1, addresses_2) IMPLIES

subset?(memory_read_transformers (pm, addresses_1), memory_read_transformers (pm, addresses_2))

% proof status:−) memory_read_transformers_union : Lemma

Forall(addresses_1, addresses_2: PRED[Address]):

union(memory_read_transformers (pm, addresses_1),

memory_read_transformers (pm, addresses_2)) =

memory_read_transformers (pm, union(addresses_1, addresses_2))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % memory_writetransformers(sets of memory_write’s) % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% the set of state transformersthat read at addresses memory_write_transformers (pm, addresses) :

PRED[[State −> SuperResult[State]]] =

Lambda(q : [State −> SuperResult[State]]) :

Exists(a : Address, b : Byte) :

addresses(a) AND q = expr_2_super (memory_write(pm)(a,b))

% the obviousrewritelemma % proof status:−) memory_write_transformers_memory_write : Lemma

Forall(addr : Address, b : Byte) : addresses(addr)

208

B.18 memory.pvs

IMPLIES

memory_write_transformers (pm, addresses)

(expr_2_super (memory_write(pm)(addr, b)))

% Monotonicity % proof status:−) memory_write_transformers_mono : Lemma

Forall(addresses_1, addresses_2: PRED[Address]) :

subset?(addresses_1, addresses_2) IMPLIES

subset?(memory_write_transformers (pm, addresses_1), memory_write_transformers (pm, addresses_2))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % side effect transformers % (sets of memory_read_side_effectand memory_write_side_effect % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

states : Var PRED[State] transformers : Var PRED[[State −> ExprResult[State, list[Byte]]]]

memory_read_side_effect_super_transformers (pm, addresses) :

PRED[[State −> SuperResult[State]]] =

Lambda(q : [State −> SuperResult[State]]) :

Exists(a : Address, bl : list[Byte], cp : bool) :

subset?(address_block(a, length(bl)), addresses) And q = expr_2_super (memory_read_side_effect (pm)(a, bl, cp))

% proof status:−) memory_read_side_effect_super_transformers_memory_read_side_effect : Lemma

Forall(a : Address, bl : list[Byte], cp : bool) :

subset?(address_block(a, length(bl)), addresses) Implies

memory_read_side_effect_super_transformers (pm, addresses) (expr_2_super (memory_read_side_effect (pm)(a, bl, cp)))

% proof status:−) memory_read_side_effect_super_transformers_mono : Lemma

Forall(addresses_1, addresses_2: PRED[Address]) :

subset?(addresses_1, addresses_2) IMPLIES

subset?(memory_read_side_effect_super_transformers (pm, addresses_1), memory_read_side_effect_super_transformers (pm, addresses_2))

memory_write_side_effect_super_transformers (pm, addresses) :

PRED[[State −> SuperResult[State]]] =

Lambda(q : [State −> SuperResult[State]]) :

Exists(a : Address, bl : list[Byte], cp : bool) :

subset?(address_block(a, length(bl)), addresses) And

q = expr_2_super (memory_write_side_effect (pm)(a, bl, cp))

209 B PVS Theory Sources

% proof status:−)

memory_write_side_effect_super_transformers_memory_write_side_effect : Lemma

Forall(a : Address, bl : list[Byte], cp : bool) :

subset?(address_block(a, length(bl)), addresses) Implies

memory_write_side_effect_super_transformers (pm, addresses) (expr_2_super (memory_write_side_effect (pm)(a, bl, cp)))

% proof status:−)

memory_write_side_effect_super_transformers_mono : Lemma Forall(addresses_1, addresses_2: PRED[Address]) : subset?(addresses_1, addresses_2) IMPLIES

subset?(memory_write_side_effect_super_transformers (pm, addresses_1), memory_write_side_effect_super_transformers (pm, addresses_2))

se_transformer: Var [Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]

se_transformer1: Var [Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]

se_transformer2: Var [Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]

se_super_transformers (addresses : PRED[Address],

se_transformer: [Address, list[Byte], bool −>

[State −> ExprResult[State, list[Byte]]]]) :

PRED[[State −> SuperResult[State]]] =

Lambda (q : [State −> SuperResult[State]]) : Exists(a : Address, bl : list[Byte], cp : bool) :

subset?(address_block(a, length(bl)), addresses) And

q = expr_2_super (se_transformer(a, bl, cp))

% side effect transformersdo not change the data read or to be written side_effect_content_unchanged (addresses : PRED[Address], states,

se_transformer) : bool =

Forall(s : State, a : Address, bl : list[Byte], cp : bool) :

states(s) And

subset?(address_block(a, length(bl)), addresses) And

OK?(se_transformer(a, bl, cp)(s)) Implies data(se_transformer(a, bl, cp)(s)) = bl

% simpleaccess lemma % proof status:−) side_effect_content_unchanged_content : Lemma

Forall(addresses : PRED[Address],

s : State, a : Address, bl : list[Byte], cp : bool) : side_effect_content_unchanged (addresses, states, se_transformer) And states(s) And subset?(address_block(a, length(bl)), addresses) And OK?(se_transformer(a, bl, cp)(s)) Implies data(se_transformer(a, bl, cp)(s)) = bl

210

B.18 memory.pvs

% proof status:−)

side_effect_content_unchanged_mono : Lemma

Forall (addresses_1, addresses_2: PRED[Address]) :

subset?(addresses_1, addresses_2) And

side_effect_content_unchanged (addresses_2, states, se_transformer)

Implies side_effect_content_unchanged (addresses_1, states, se_transformer)

% proof status:−)

side_effect_content_unchanged_composition : Lemma

transformer_invariant?(states,

se_super_transformers (addresses, se_transformer1)) And

side_effect_content_unchanged (addresses, states, se_transformer1) And side_effect_content_unchanged (addresses, states, se_transformer2)

Implies

side_effect_content_unchanged (addresses, states, Lambda(a : Address, bl : list[Byte], cp : bool) :

se_transformer1(a, bl, cp) ## Lambda (bl1 : list[Byte]) :

se_transformer2(a, bl1, cp))

end Memory

Memory_Change[State : Type] : Theory

%

% this theorydefinesthe unchangedabstraction

% Begin

IMPORTING Memory

pm : Var Memory_struct[State] states : VAR PRED[State] transformers : Var PRED[[State −> SuperResult[State]]] addresses : Var PRED[Address]

% proof status:−)

% unchanged_memory_invariant ?_TCC1: TCCObligation

% Unchangedabstraction: For % − an arbitrarymemory, % − a set of states % − a set of state transformersand % − a set of addresses % unchanged_memory_invariant ? holds if % − states form an invariantwrt. all elementsof transformers % − all transformersleave the valuesat all addressesunchanged unchanged_memory_invariant ?(pm, states, transformers, addresses) : bool =

transformer_invariant?(states, transformers) AND

Forall(s : State, q : [State −> SuperResult[State]], a : Address) : states(s) AND transformers(q) AND addresses(a) AND OK?(q(s)) AND

211 B PVS Theory Sources

OK?(memory_read(pm)(a)(s)) AND OK?(memory_read(pm)(a)(state(q(s)))) IMPLIES

data(memory_read(pm)(a)(state(q(s)))) = data(memory_read(pm)(a)(s))

% proof status:−)

% unchanged_memory_invariant_unchanged_TCC1 : TCCObligation

% access lemma % proof status:−) unchanged_memory_invariant_unchanged : Lemma

Forall(s : State, q : [State −> SuperResult[State]], a : Address) :

unchanged_memory_invariant ?(pm, states, transformers, addresses) AND states(s) AND transformers(q) AND addresses(a) AND OK?(q(s)) AND OK?(memory_read(pm)(a)(s)) AND OK?(memory_read(pm)(a)(state(q(s)))) IMPLIES

data(memory_read(pm)(a)(state(q(s)))) = data(memory_read(pm)(a)(s))

% proof status:−)

unchanged_memory_invariant_invariant : Lemma

unchanged_memory_invariant ?(pm, states, transformers, addresses) Implies transformer_invariant?(states, transformers)

% Monotonicitylemma % proof status:−) unchanged_memory_invariant_mono : Lemma

Forall(transformers_1, transformers_2: PRED[[State −> SuperResult[State]]],

addresses_1, addresses_2: PRED[Address]) : subset?(transformers_1, transformers_2) AND subset?(addresses_1, addresses_2) AND unchanged_memory_invariant ?(pm, states, transformers_2, addresses_2)

IMPLIES unchanged_memory_invariant ?(pm, states, transformers_1, addresses_1)

% proof status:−)

% unchanged_memory_invariant_next_ok_TCC1 : TCCObligation

% invariantlemma % proof status:−) unchanged_memory_invariant_next_ok : LEMMA

FORALL(s: State, q: [State −> SuperResult[State]]):

unchanged_memory_invariant ?(pm, states, transformers, addresses) AND states(s) AND transformers(q) AND has_next_state (q(s)) IMPLIES states(state(q(s)))

% lemmafor unionof transformers

212

B.18 memory.pvs

% proof status:−)

unchanged_memory_invariant_union_transformers : Lemma

Forall(transformers_1, transformers_2:

PRED[[State −> SuperResult[State]]]) : unchanged_memory_invariant ?(pm, states, transformers_1, addresses) AND unchanged_memory_invariant ?(pm, states, transformers_2, addresses)

IMPLIES

unchanged_memory_invariant ?(pm, states, union(transformers_1, transformers_2), addresses)

% lemmafor unionof addresssets

% proof status:−)

unchanged_memory_invariant_union_addresses : Lemma Forall(addresses_1, addresses_2: PRED[Address]) :

unchanged_memory_invariant ?(pm, states, transformers, addresses_1) AND unchanged_memory_invariant ?(pm, states, transformers, addresses_2)

IMPLIES

unchanged_memory_invariant ?(pm, states, transformers, union(addresses_1, addresses_2))

% An emptyaddressset does not automaticallyimplyan

% unchanged_memory_invariant , because states and transformersmust

% form a transformerinvariant(independentof any address).

% proof status:−)

unchanged_memory_invariant_empty : Lemma

empty?(states) OR empty?(transformers) Implies unchanged_memory_invariant ?(pm, states, transformers, addresses)

% proof status:−)

unchanged_memory_invariant_all_transformers : Lemma

(Forall (q : [State −> SuperResult[State]]) : transformers(q) Implies unchanged_memory_invariant ?(pm, states, singleton(q), addresses))

Implies unchanged_memory_invariant ?(pm, states, transformers, addresses)

End Memory_Change

Memory_Change_3 [State : Type, Data : Type] : Theory

% repeata few lemmasfrom above for non−supertransformers Begin

Importing Memory_Change

pm : Var Memory_struct[State] states : VAR PRED[State] transformers : Var PRED[[State −> SuperResult[State]]] addresses : Var PRED[Address]

% proof status:−)

% expr_unchanged_memory_invariant_unchanged_TCC1 : TCCObligation

213 B PVS Theory Sources

% proof status:−)

expr_unchanged_memory_invariant_unchanged : Lemma

Forall(s : State, q : [State −> ExprResult[State, Data]], a : Address) : unchanged_memory_invariant ?(pm, states, transformers, addresses) AND states(s) AND transformers(expr_2_super (q)) AND addresses(a) AND OK?(q(s)) AND OK?(memory_read(pm)(a)(s)) AND OK?(memory_read(pm)(a)(state(q(s)))) IMPLIES

data(memory_read(pm)(a)(state(q(s)))) = data(memory_read(pm)(a)(s))

% proof status:−)

% expr_unchanged_memory_invariant_next_ok_TCC1 : TCCObligation

% proof status:−)

expr_unchanged_memory_invariant_next_ok : LEMMA

FORALL(s: State, q: [State −> ExprResult[State, Data]]):

unchanged_memory_invariant ?(pm, states, transformers, addresses) AND states(s) AND transformers(expr_2_super (q)) AND has_next_state (q(s)) IMPLIES states(state(q(s)))

End Memory_Change_3

Memory_Change_4 [State : Type, Data1, Data2 : Type] : Theory

Begin

Importing Memory_Change_3

pm : Var Memory_struct[State]

states : Var PRED[State]

transformers_1: Var PRED[[State −> SuperResult[State]]] transformers_2: Var PRED[[State −> SuperResult[State]]] addresses : Var PRED[Address]

% proof status:−)

expr_unchanged_memory_invariant_composition : Lemma Forall (q1 : [State −> ExprResult[State, Data1]],

q2 : [State −> ExprResult[State, Data2]]) : transformers_1(expr_2_super (q1)) And transformers_2(expr_2_super (q2)) And transformers_ok?(states, memory_read_transformers (pm, addresses)) And unchanged_memory_invariant ?(pm, states, transformers_1, addresses) And unchanged_memory_invariant ?(pm, states, transformers_2, addresses)

Implies unchanged_memory_invariant ?(pm, states, singleton(expr_2_super (q1 ## q2)), addresses)

% proof status:−)

fexpr_unchanged_memory_invariant_composition : Lemma Forall (q1 : [State −> ExprResult[State, Data1]],

q2 : [Data1 −> [State −> ExprResult[State, Data2]]],

P : PRED[Data1]) :

214

B.18 memory.pvs

transformers_1(expr_2_super (q1)) And

transformers_ok?(states, memory_read_transformers (pm, addresses)) And unchanged_memory_invariant ?(pm, states, transformers_1, addresses) And (Forall (s : (states)) : OK?(q1(s)) Implies P(data(q1(s)))) And (Forall (d : (P)) : unchanged_memory_invariant ?(pm, states,

singleton(expr_2_super (q2(d))), addresses))

Implies unchanged_memory_invariant ?(pm, states, singleton(expr_2_super (q1 ## q2)), addresses)

End Memory_Change_4

Memory_Change_2 [State : Type] : Theory

%

% Here the unchangedabstractionis furtherspecialized. % Thereis also a changedabstraction(for memorywrites) % (all this cannot go in the previoustheorybecause of % the typeparameterData there) % % in the end all this is used to proveresultsabout % memory_read_listafter memory_write_list % and % memory_read_listafter memory_read_list % Begin

IMPORTING Memory_Change_3

pm : Var Memory_struct[State]

states : VAR PRED[State] addresses : Var PRED[Address]

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% specialunchangedfor memory_write

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% The followingis a variationof

%

% unchanged_memory_invariant ?(pm, states, % memory_write_transformers (pm, addresses), % addresses) % % The variationis that it excludesthe obviouslywrong cases: % writingat a _changes_addressa. unchanged_memory_write_invariant ?(pm, states, addresses) : bool =

Forall(waddr : Address, b : Byte) : addresses(waddr) IMPLIES

unchanged_memory_invariant ?(pm, states, singleton(expr_2_super (memory_write(pm)(waddr,b))),

215 B PVS Theory Sources

remove(waddr, addresses))

% Monotonicity % proof status:−) unchanged_memory_write_invariant_mono_addresses : Lemma

Forall(addresses_1, addresses_2: PRED[Address]) :

subset?(addresses_1, addresses_2) AND

unchanged_memory_write_invariant ?(pm, states, addresses_2)

IMPLIES unchanged_memory_write_invariant ?(pm, states, addresses_1)

% connect unchanged_memory_write_invariant ? withtransformer_invariant ?

% proof status:−)

unchanged_memory_write_invariant_transformer_invariant : Lemma unchanged_memory_write_invariant ?(pm, states, addresses)

IMPLIES transformer_invariant?(states, memory_write_transformers (pm,addresses))

% connect unchanged_memory_write_invariant withunchanged_memory_invariant ? % for a subset of unchangedaddresses % proof status:−) unchanged_memory_write_invariant_unchanged_memory_invariant : Lemma

Forall(all_addresses, unchanged_addresses,

changed_addresses: PRED[Address]) : unchanged_memory_write_invariant ?(pm, states, all_addresses) AND subset?(unchanged_addresses, all_addresses) AND subset?(changed_addresses, all_addresses) AND disjoint?(unchanged_addresses, changed_addresses)

IMPLIES

unchanged_memory_invariant ?(pm, states,

memory_write_transformers (pm, changed_addresses), unchanged_addresses)

% connect unchanged_memory_invariant and unchanged_memory_write_invariant % to a largerunchanged_memory_invariant % proof status:−) unchanged_memory_invariant_union : Lemma

Forall (ro_addr, rw_addr, mod_addr: PRED[Address]) :

unchanged_memory_invariant ?(pm, states,

memory_write_transformers (pm, rw_addr), ro_addr) And unchanged_memory_write_invariant ?(pm, states, rw_addr) And subset?(mod_addr, rw_addr)

Implies

unchanged_memory_invariant ?(pm, states, memory_write_transformers (pm, mod_addr), difference(union(ro_addr, rw_addr), mod_addr))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% some invariantlemmasfor write_list

216

B.18 memory.pvs

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% wrt transformer_invariant

% proof status:−)

transformer_invariant_write_list_nse : Lemma

Forall(waddr : Address, bl : list[Byte], s : State) :

transformer_invariant?(states,

memory_write_transformers (pm, address_block(waddr, length(bl))))

AND states(s) IMPLIES

result_pred(states)

(expr_2_super (memory_write_list_nse (pm)(waddr, bl))(s))

% proof status:−)

transformer_invariant_write_list : Lemma

Forall(waddr : Address, bl : list[Byte], s : State) :

transformer_invariant?(states,

add( expr_2_super (memory_write_side_effect (pm)(waddr, bl, false)), memory_write_transformers (pm, address_block(waddr, length(bl)))))

And

side_effect_content_unchanged (address_block(waddr, length(bl)), states,

memory_write_side_effect (pm))

And states(s) Implies

result_pred(states)(expr_2_super (memory_write_list (pm)(waddr, bl))(s))

% wrt unchanged_memory_invariant ? and read_memory

% see below

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % changedabstractionfor memory_read/memory_write % % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−)

% changed_memory_invariant ?_TCC1: TCCObligation

changed_memory_invariant ?(pm, states, addresses) : bool = transformer_invariant?(states, memory_read_transformers (pm, addresses)) AND transformer_invariant?(states, memory_write_transformers (pm, addresses)) AND Forall(s : State, a : Address, b : Byte) : states(s) AND addresses(a) AND OK?(memory_write(pm)(a,b)(s)) AND OK?(memory_read(pm)(a)(state(memory_write(pm)(a,b)(s))))

217 B PVS Theory Sources

IMPLIES data(memory_read(pm)(a)(state(memory_write(pm)(a,b)(s)))) = b

% proof status:−)

changed_memory_invariant_mono : Lemma

Forall(addresses_1, addresses_2: PRED[Address]) :

subset?(addresses_1, addresses_2) AND

changed_memory_invariant ?(pm, states, addresses_2)

IMPLIES change

Contents for Appendix C

C.44.74 dt_cv_ptm_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042
C.44.75 dt_cv_ptm_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1043
C.44.76 dt_cv_ptm_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047
C.44.77 dt_cv_ptm_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047
C.44.78 dt_cv_ptm_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048
C.44.79 dt_cv_ptm_TCC11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048
C.44.80 dt_cv_ptm_TCC12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049
C.44.81 dt_cv_ptm_TCC13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049
C.44.82 dt_cv_ptm_TCC14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1052
C.44.83 dt_cv_ptm_TCC15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1053
C.44.84 dt_cv_float_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1054
C.44.85 dt_cv_float_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1054
C.44.86 dt_cv_float_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
C.44.87 dt_cv_float_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
C.44.88 dt_cv_float_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
C.44.89 dt_cv_float_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
C.44.90 dt_cv_float_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1057
C.44.91 dt_cv_float_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1061
C.44.92 dt_cv_float_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1061
C.44.93 dt_cv_float_TCC10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1062
C.44.94 dt_cv_float_TCC11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1062
C.44.95 dt_cv_float_TCC12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1063
C.44.96 dt_cv_float_TCC13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1064
C.44.97 dt_cv_float_TCC14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1067
C.44.98 dt_cv_float_TCC15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1068
C.44.99 uidt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069
C.44.100 uidt_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069
C.44.101 uidt_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069
C.44.102 uidt_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1070
C.44.103 uidt_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1070
C.44.104 uidt_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1070
C.44.105 uidt_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.106 uidt_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.107 uidt_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.108 uidt_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.109 uidt_TCC11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
C.44.110 uidt_TCC12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
C.44.111 uidt_TCC13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
C.44.112 uidt_TCC14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
C.44.113 uidt_TCC15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
C.44.114 uidt_TCC16. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
C.44.115 uidt_TCC17. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074
C.44.116 uidt_TCC18. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074
C.44.117 uidt_TCC19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
C.44.118 uidt_TCC20. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
C.44.119 uidt_TCC21. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
C.44.120 uidt_TCC22. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076
C.44.121 uidt_TCC23. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076
C.44.122 uidt_TCC24. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076
C.44.123 uidt_TCC25. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077
C.44.124 uidt_TCC26. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077
C.44.125 uidt_TCC27. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077

461 C Proof scripts

C.44.126 uidt_TCC28. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
C.44.127 uidt_TCC29. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
C.44.128 uidt_TCC30. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
C.44.129 uidt_TCC31. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079
C.44.130 uidt_TCC32. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079
C.44.131 uidt_TCC33. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079
C.44.132 uidt_TCC34. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
C.44.133 uidt_TCC35. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
C.44.134 uidt_TCC36. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
C.44.135 uidt_TCC37. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081
C.44.136 uidt_TCC38. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081
C.44.137 uidt_TCC39. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082
C.44.138 uidt_TCC40. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082
C.44.139 uidt_TCC41. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083
C.44.140 mod_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083
C.44.141 value_bitmask_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
C.45 Proofs for Cpp_Verification (cpp-verification.pvs) . . . . . . . . . . . . . . . . . . . . . 1084
C.46 Proofs for Cpp_array (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
C.46.1 uidt_array_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
C.47 Proofs for Cpp_bitfield (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085
C.47.1 range_bitfield_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085
C.47.2 bitfield_range_underlying_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1086
C.47.3 bitfield_range_underlying_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 1086
C.47.4 bitfield_range_underlying_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . 1086
C.47.5 dt_bitfield_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
C.48 Proofs for Cpp_bool (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
C.48.1 range_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
C.48.2 dt_bool_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49 Proofs for Cpp_char (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.1 dt_char_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.2 value_bitmask_char_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.3 min_char. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.4 max_char . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089
C.49.5 char_binary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091
C.50 Proofs for Cpp_class (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094
C.50.1 uidt_class_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094
C.51 Proofs for Cpp_const_volatile (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.51.1 dt_volatile_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.52 Proofs for Cpp_double (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.52.1 dt_double_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.53 Proofs for Cpp_enum (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.1 valid_range?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.2 valid_range?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.3 range_enum_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.4 dt_enum_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1097
C.53.5 value_bitmask_enum_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098
C.53.6 enum_size_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.53.7 enum_size_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.54 Proofs for Cpp_float (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.54.1 range_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.54.2 dt_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
C.55 Proofs for Cpp_function (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100

462

Contents for Appendix C

C.55.1 uidt_function_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
C.55.2 dt_vtable_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
C.56 Proofs for Cpp_int (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101
C.56.1 range_int_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101
C.56.2 dt_int_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.56.3 value_bitmask_int_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.57 Proofs for Cpp_long (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.57.1 range_long_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.57.2 dt_long_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.57.3 value_bitmask_long_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.58 Proofs for Cpp_longdouble (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.58.1 dt_longdouble_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.59 Proofs for Cpp_longlong (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.59.1 range_longlong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.59.2 dt_longlong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.59.3 value_bitmask_longlong_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.60 Proofs for Cpp_pointer (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.60.1 dt_pointer_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.60.2 pointers_to_layout_compatible_range_TCC1 . . . . . . . . . . . . . . . . . . . 1105
C.60.3 pointers_to_layout_compatible_range_TCC2 . . . . . . . . . . . . . . . . . . . 1105
C.60.4 pointers_to_layout_compatible_range_TCC3 . . . . . . . . . . . . . . . . . . . 1106
C.60.5 pointers_to_layout_compatible_range_TCC4 . . . . . . . . . . . . . . . . . . . 1106
C.60.6 pointers_to_layout_compatible_dt_TCC1 . . . . . . . . . . . . . . . . . . . . . 1106
C.60.7 void_pointer_char_pointer_dt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.8 add_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.9 add_spec2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.10 add_spec2_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.11 add_simplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108
C.60.12 void_pointer_other_pointer_value_TCC1 . . . . . . . . . . . . . . . . . . . . . 1110
C.60.13 void_pointer_other_pointer_value_TCC2 . . . . . . . . . . . . . . . . . . . . . 1110
C.61 Proofs for Cpp_pointer_to_member (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1111
C.61.1 dt_ptm_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111
C.62 Proofs for Cpp_reference (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.62.1 dt_reference_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.63 Proofs for Cpp_schar (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.63.1 range_schar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.63.2 dt_schar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113
C.63.3 schar_value_eq_uchar_value_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1113
C.63.4 value_bitmask_schar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113
C.64 Proofs for Cpp_short (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.64.1 range_short_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.64.2 dt_short_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.64.3 value_bitmask_short_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.65 Proofs for Cpp_uchar (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.65.1 range_uchar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.65.2 dt_uchar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.65.3 value_bitmask_uchar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.66 Proofs for Cpp_uint (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1116
C.66.1 range_uint_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1116
C.66.2 dt_uint_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1116
C.66.3 uint_represenation_same_for_positive_int_TCC1 . . . . . . . . . . . . . . . . . 1116
C.66.4 value_bitmask_uint_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117

463 C Proof scripts

C.67 Proofs for Cpp_ulong (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117
C.67.1 range_ulong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117
C.67.2 dt_ulong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117
C.67.3 ulong_represenation_same_for_positive_long_TCC1 . . . . . . . . . . . . . . . 1118
C.67.4 value_bitmask_ulong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
C.68 Proofs for Cpp_ulonglong (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
C.68.1 range_ulonglong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
C.68.2 dt_ulonglong_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
C.68.3 ulonglong_represenation_same_for_positive_longlong_TCC1 . . . . . . . . . . . 1119
C.68.4 value_bitmask_ulonglong_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
C.69 Proofs for Cpp_union (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.69.1 uidt_union_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.70 Proofs for Cpp_ushort (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.70.1 range_ushort_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.70.2 dt_ushort_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121
C.70.3 ushort_represenation_same_for_positive_short_TCC1 . . . . . . . . . . . . . . 1121
C.70.4 value_bitmask_ushort_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121
C.71 Proofs for Cpp_wchar_t (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.71.1 range_wchar_t_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.71.2 dt_wchar_t_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.71.3 value_bitmask_wchar_t_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.72 Proofs for Datatype_Model (datatype_model.pvs). . . . . . . . . . . . . . . . . . . . . 1123
C.72.1 uidt_1_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.2 pod_1_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.3 pod_1_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.4 pod_1_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.5 pod_1_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
C.72.6 uidt_2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
C.72.7 pod_2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
C.72.8 pod_2_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
C.72.9 pod_2_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
C.73 Proofs for Datatype_Model_2 (datatype_model.pvs). . . . . . . . . . . . . . . . . . . . 1125
C.73.1 uidt_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
C.73.2 pod_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126
C.73.3 pod_bool_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.4 pod_bool_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.5 pod_bool_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.6 pod_bool_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.7 pod_bool_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1128
C.73.8 uidt_Byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
C.73.9 uidt_Byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
C.73.10 pod_Byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
C.73.11 pod_Byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
C.73.12 pod_Byte_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
C.73.13 pod_Byte_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
C.73.14 pod_Byte_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1131
C.74 Proofs for DeclarationStatements1 (statements.pvs) . . . . . . . . . . . . . . . . . . . . 1131
C.75 Proofs for DeclarationStatements2 (statements.pvs) . . . . . . . . . . . . . . . . . . . . 1131
C.76 Proofs for Device_Memory (device_memory.pvs). . . . . . . . . . . . . . . . . . . . . . 1131
C.77 Proofs for EqualityExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 1131
C.78 Proofs for Error_Code_Types (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 1131
C.79 Proofs for Even_More_List_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . 1132

464

Contents for Appendix C

C.79.1 every_extend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1132
C.80 Proofs for Exception_type (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 1132
C.81 Proofs for Exception_type_adt (Exception_type_adt.pvs) . . . . . . . . . . . . . . . . . 1132
C.82 Proofs for Exception_type_adt_reduce (Exception_type_adt.pvs) . . . . . . . . . . . . . 1133
C.83 Proofs for Expand_State (device_memory.pvs). . . . . . . . . . . . . . . . . . . . . . . 1133
C.83.1 em_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133
C.83.2 em_transformer_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133
C.83.3 em_lift_singleton. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133
C.84 Proofs for Expand_State2 (device_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . 1134
C.84.1 em_lift_expr_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134
C.85 Proofs for Expand_State3 (device_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . 1134
C.85.1 em_memory_read_transformers. . . . . . . . . . . . . . . . . . . . . . . . . . 1134
C.85.2 em_memory_write_transformers . . . . . . . . . . . . . . . . . . . . . . . . . . 1135
C.85.3 em_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . . . . . . 1137
C.85.4 em_changed_memory_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . 1137
C.85.5 em_const_unchanged_memory_invariant_TCC1 . . . . . . . . . . . . . . . . . 1139
C.85.6 em_const_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . . 1139
C.85.7 em_side_effect_content_unchanged . . . . . . . . . . . . . . . . . . . . . . . . . 1140
C.86 Proofs for ExprResult (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140
C.87 Proofs for ExprResult_adt (ExprResult_adt.pvs). . . . . . . . . . . . . . . . . . . . . . 1140
C.88 Proofs for ExprResult_adt_map (ExprResult_adt.pvs) . . . . . . . . . . . . . . . . . . . 1140
C.89 Proofs for ExprResult_adt_reduce (ExprResult_adt.pvs) . . . . . . . . . . . . . . . . . . 1141
C.90 Proofs for ExpressionStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1141
C.91 Proofs for Expression_Composition_Rewrites (state-transformer.pvs) . . . . . . . . . . . 1141
C.91.1 comp_eval_if_ok_fexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141
C.92 Proofs for Expressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 1141
C.93 Proofs for Expt_Lemmas (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1141
C.93.1 both_sides_expt_gt1_le . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141
C.93.2 expt_plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94 Proofs for Extended_Real (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.1 number_field_extended. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.2 er_plus_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.3 er_neg_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.4 er_plus_number_field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.5 er_minus_number_field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.6 er_times_number_field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.7 er_div_number_field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.8 er_neg_number_field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.9 er_plus_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.10 er_minus_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.11 er_times_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.12 er_div_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.13 er_neg_real . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.14 er_plus_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.15 er_minus_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.16 er_times_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.17 er_div_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.18 er_neg_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.19 er_plus_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.20 er_minus_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147
C.94.21 er_times_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147
C.94.22 er_neg_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147

465 C Proof scripts

C.95 Proofs for Finite_Set_Reduce (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . 1147
C.95.1 list_of_finite_set_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147
C.95.2 list_of_finite_set_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1148
C.95.3 length_list_of_finite_set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1148
C.95.4 member_list_of_finite_set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1149
C.95.5 unique_member_list_of_finite_set . . . . . . . . . . . . . . . . . . . . . . . . . . 1151
C.96 Proofs for General (constants.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.96.1 Byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.96.2 less_than_max_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.97 Proofs for Graph (graph.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.97.1 path?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.97.2 path?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.3 path?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.4 path?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.5 nodes_path_start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.6 nodes_path_end. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1158
C.97.7 path_head_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1158
C.97.8 path_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1159
C.97.9 path_tail_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1159
C.97.10 path_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160
C.97.11 path_cdr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160
C.97.12 path_cdr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1161
C.97.13 path_concat_path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1161
C.97.14 trans_closure_char_graph . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1164
C.97.15 path_cycle_free. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1167
C.97.16 different_nodes_on_edge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171
C.97.17 tree_path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1172
C.97.18 root_path_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177
C.97.19 path_length_bound_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177
C.97.20 path_length_bound. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177
C.97.21 non_root_path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1178
C.97.22 non_root_path_extend_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1180
C.97.23 non_root_path_extend. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1180
C.97.24 tree_path_to_root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182
C.97.25 tree_unique_path_to_root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1187
C.97.26 root_path_singleton. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1196
C.97.27 path_to_root_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
C.97.28 path_factor_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
C.97.29 path_factor_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
C.97.30 path_factor_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
C.97.31 path_factor_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
C.97.32 path_factor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199
C.97.33 node_pair_distinction_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1206
C.97.34 node_pair_distinction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207
C.97.35 symmetric_node_pair_distinction_TCC1 . . . . . . . . . . . . . . . . . . . . . 1226
C.97.36 symmetric_node_pair_distinction. . . . . . . . . . . . . . . . . . . . . . . . . 1227
C.98 Proofs for Graph_Relations (graph.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.1 trans_closure_char_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.2 trans_closure_char_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.3 trans_closure_char_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.4 trans_closure_char. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1229
C.99 Proofs for Graph_Util (graph.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238

466

Contents for Appendix C

C.99.1 every_nth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238
C.99.2 nth_append_left_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1240
C.99.3 nth_append_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241
C.99.4 nth_append_right_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242
C.99.5 nth_append_right. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242
C.99.6 list_pred_card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1243
C.99.7 path_start_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
C.99.8 path_end_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
C.99.9 path_list_induction_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
C.99.10 path_list_induction_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248
C.99.11 path_list_induction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248
C.99.12 concat_path_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1249
C.99.13 concat_path_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1249
C.99.14 length_concat_path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250
C.100 Proofs for Hoare (hoare.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250
C.100.1 valid_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250
C.100.2 valid_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251
C.100.3 valid_and . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251
C.100.4 valid_implied . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251
C.100.5 Valid_and . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.101 Proofs for IA32 (constants.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.101.1 max_linear_offset_val . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.101.2 mem_addr_4g_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.102 Proofs for Import_All (everything.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.103 Proofs for IntegralConversions (conversions.pvs) . . . . . . . . . . . . . . . . . . . . . . 1252
C.104 Proofs for IntegralPromotions (conversions.pvs) . . . . . . . . . . . . . . . . . . . . . . 1253
C.104.1 int_conversion_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1253
C.104.2 int_conversion_spec_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1253
C.104.3 int_conversion_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1254
C.104.4 int_conversion_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255
C.104.5 bool2int_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255
C.104.6 bool2int_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256
C.105 Proofs for Interpreted_Data (abstract_data.pvs). . . . . . . . . . . . . . . . . . . . . . 1256
C.105.1 interpreted_data_type?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256
C.105.2 pod_is_interpreted_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.3 pod_size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.4 data_type_length. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.5 length_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.6 valid_from_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.7 valid_iff_from_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.8 valid_to_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.9 up_from_byte_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.10 from_byte_to_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259
C.105.11 in_blessed_memory_subset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259
C.106 Proofs for Interpreted_Data_Lift (abstract_data.pvs) . . . . . . . . . . . . . . . . . . . . 1259
C.107 Proofs for IterationStatements1 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1259
C.107.1 iterate_while_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259
C.107.2 iterate_while_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.3 while_termination_point?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.4 while_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.5 nonzero_min_while_termination_point . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.6 while_as_if_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1261

467 C Proof scripts

C.107.7 iterate_do_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1282
C.107.8 do_termination_point?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . 1283
C.107.9 termination_point_do_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 1283
C.107.10 termination_point_do_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . . 1283
C.107.11 do_while_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284
C.107.12 do_as_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284
C.107.13 do_while_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
C.108 Proofs for IterationStatements2 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1287
C.108.1 iterate_for_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
C.108.2 iterate_for_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
C.108.3 iterate_for_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288
C.108.4 iterate_for_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288
C.108.5 for_termination_point?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1290
C.108.6 termination_point_for_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . 1291
C.108.7 termination_point_for_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . 1292
C.108.8 min_termination_point_for_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . 1292
C.108.9 min_termination_point_for_as_while_TCC2 . . . . . . . . . . . . . . . . . . . . 1292
C.108.10 min_termination_point_for_as_while_TCC3 . . . . . . . . . . . . . . . . . . . . 1294
C.108.11 min_termination_point_for_as_while . . . . . . . . . . . . . . . . . . . . . . . . 1295
C.108.12 nonzero_min_for_termination_point_TCC1 . . . . . . . . . . . . . . . . . . . . 1296
C.108.13 nonzero_min_for_termination_point . . . . . . . . . . . . . . . . . . . . . . . . 1297
C.108.14 for_as_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1297
C.108.15 for_unroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1324
C.109 Proofs for IterationStatements3 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1325
C.109.1 do_while_inv_unroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1325
C.110 Proofs for IterationStatements4 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1325
C.110.1 for_inv_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1325
C.111 Proofs for JumpStatements1 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1326
C.112 Proofs for JumpStatements2 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1326
C.113 Proofs for LabeledStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1326
C.114 Proofs for Linear_Memory (linear_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . 1326
C.114.1 xlat_idx_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1326
C.114.2 xlat_idx_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.3 xlat_idx_pe_aligned_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.4 xlat_idx_pe_aligned_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.5 xlat_idx_pe_aligned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.6 xlat_idx_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1331
C.114.7 xlat_idx_memory_address2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1332
C.114.8 xlat_ofs_memory_address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
C.114.9 xlat_ofs_memory_address2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
C.114.10 raise_fault_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1334
C.114.11 translate_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1335
C.114.12 translate_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1335
C.114.13 translate_memory_address2. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1340
C.114.14 translate_result_leaf_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
C.114.15 translate_result_leaf_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
C.114.16 translate_result_leaf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
C.114.17 translate_result_no_leaf_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1347
C.114.18 translate_result_no_leaf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1347
C.114.19 linear_resolve_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1348
C.114.20 linear_resolve_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1348
C.114.21 linear_resolve_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1349

468

Contents for Appendix C

C.114.22 linear_resolve_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1349
C.114.23 linear_resolve_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1350
C.114.24 linear_resolve_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1350
C.114.25 linear_resolve_TCC7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1351
C.114.26 linear_resolve_TCC8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1351
C.114.27 linear_resolve_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . 1352
C.114.28 linear_read_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
C.114.29 linear_read_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
C.114.30 linear_read_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
C.114.31 linear_read_side_effect_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1362
C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs). . . . . . . . . . . . . . . . . 1364
C.115.1 PTab_Address_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.2 pe_in_pdir_range?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.3 pe_in_ptab_range?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.4 pe_in_ptab_range?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.5 pe_in_ptab_range?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
C.115.6 pe_in_ptab_range?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
C.115.7 pe_in_pt_range?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
C.115.8 pe_in_pt_range?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
C.115.9 pe_in_pt_range_aligned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
C.115.10 pe_in_pt_address_in_pt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1367
C.115.11 is_linear_plain_memory?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1369
C.115.12 is_linear_plain_memory?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 1370
C.115.13 is_linear_plain_memory?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . 1370
C.115.14 is_linear_plain_memory?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . 1371
C.115.15 is_linear_plain_memory?_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . 1371
C.115.16 is_linear_plain_memory?_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . 1373
C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs) . . . . . . . . . . . 1377
C.116.1 linear_plain_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1377
C.116.2 linear_plain_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . 1409
C.116.3 linear_plain_unchanged_memory_invariant_write . . . . . . . . . . . . . . . . . 1472
C.116.4 linear_plain_unchanged_memory_write_invariant . . . . . . . . . . . . . . . . . 1488
C.116.5 linear_plain_transformer_invariant . . . . . . . . . . . . . . . . . . . . . . . . . 1509
C.116.6 linear_plain_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . . . 1511
C.116.7 linear_plain_read_side_effect_unchanged . . . . . . . . . . . . . . . . . . . . . . 1538
C.116.8 linear_plain_write_side_effect_unchanged . . . . . . . . . . . . . . . . . . . . . 1551
C.116.9 linear_memory_plain_memory. . . . . . . . . . . . . . . . . . . . . . . . . . . 1562
C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs). . . . . . . . . . . . . . . . 1563
C.117.1 pm_read_linear. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
C.117.2 pm_write_linear. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
C.117.3 pm_read_side_effect_linear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
C.117.4 pm_write_side_effect_linear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
C.117.5 pm_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
C.117.6 pm_plain_phy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
C.117.7 pm_memory_addr_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
C.117.8 pm_memory_addr_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
C.117.9 pm_memory_addr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
C.117.10 pm_linear_blessed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566
C.117.11 pm_linear_resolve_read_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1566
C.117.12 pm_linear_resolve_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566
C.117.13 pm_linear_resolve_write_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1567
C.117.14 pm_linear_resolve_write_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1567

469 C Proof scripts

C.117.15 pm_linear_resolve_reg_transformers_other . . . . . . . . . . . . . . . . . . . . . 1567
C.117.16 pm_unchanged_singleton_linear_resolve_reg_transformers . . . . . . . . . . . . 1568
C.117.17 pm_address_in_pt_range_in_rw_addr . . . . . . . . . . . . . . . . . . . . . . . . 1572
C.117.18 address_block_in_memory_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1572
C.117.19 address_block_in_memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1573
C.117.20 address_block_in_memory2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1574
C.117.21 raise_fault_transformer_invariant. . . . . . . . . . . . . . . . . . . . . . . . . 1574
C.117.22 raise_fault_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . . 1577
C.117.23 apply_side_effects_pm_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1583
C.117.24 apply_side_effects_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586
C.117.25 apply_side_effects_same_result_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 1589
C.117.26 apply_side_effects_same_result . . . . . . . . . . . . . . . . . . . . . . . . . . . 1589
C.117.27 apply_side_effects_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . 1614
C.117.28 subset_ptab_address_rw_addr . . . . . . . . . . . . . . . . . . . . . . . . . . . 1626
C.117.29 translate_transformer_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . 1627
C.117.30 translate_unchanged_pm_phy_except_pe_TCC1 . . . . . . . . . . . . . . . . . 1637
C.117.31 translate_unchanged_pm_phy_except_pe_TCC2 . . . . . . . . . . . . . . . . . 1637
C.117.32 translate_unchanged_pm_phy_except_pe . . . . . . . . . . . . . . . . . . . . . 1638
C.117.33 translate_result_ok_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1658
C.117.34 translate_result_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1659
C.117.35 translate_result_as_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1675
C.117.36 translate_result_as_read_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 1675
C.117.37 translate_result_as_read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
C.117.38 translate_same_result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
C.117.39 xlat_pe_in_pdir_range_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1677
C.117.40 xlat_pe_in_pdir_range_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1677
C.117.41 xlat_pe_in_pdir_range_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1678
C.117.42 xlat_pe_in_pdir_range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1684
C.117.43 xlat_pe_in_pt_range_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1686
C.117.44 xlat_pe_in_pt_range_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1687
C.117.45 xlat_pe_in_pt_range_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1687
C.117.46 xlat_pe_in_pt_range_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1688
C.117.47 xlat_pe_in_pt_range_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1690
C.117.48 xlat_pe_in_pt_range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1704
C.117.49 linear_resolve_unchanged_pm_phy . . . . . . . . . . . . . . . . . . . . . . . . . 1734
C.117.50 linear_resolve_read_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . 1914
C.117.51 linear_resolve_write_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . 1914
C.117.52 linear_resolve_transformer_invariant . . . . . . . . . . . . . . . . . . . . . . . . 1915
C.117.53 linear_resolve_states_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1915
C.117.54 linear_resolve_states. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1916
C.117.55 linear_resolve_same_result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1916
C.117.56 delta_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2012
C.117.57 xlat_idx_same_page_address_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2014
C.117.58 xlat_idx_same_page_address_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . 2015
C.117.59 xlat_idx_same_page_address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2015
C.117.60 xlat_ofs_same_page_address_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2028
C.117.61 xlat_ofs_same_page_address_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . 2028
C.117.62 xlat_ofs_same_page_address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2029
C.117.63 translate_same_page_address_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2036
C.117.64 translate_same_page_address_result . . . . . . . . . . . . . . . . . . . . . . . . 2039
C.117.65 linear_resolve_same_page_address_ok_TCC1 . . . . . . . . . . . . . . . . . . . 2043
C.117.66 linear_resolve_same_page_address_ok . . . . . . . . . . . . . . . . . . . . . . . 2043

470

Contents for Appendix C

C.117.67 linear_resolve_same_page_address_TCC1 . . . . . . . . . . . . . . . . . . . . . 2079
C.117.68 linear_resolve_same_page_address . . . . . . . . . . . . . . . . . . . . . . . . . 2079
C.117.69 address_block_split_type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2079
C.117.70 same_page_address_block_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2083
C.117.71 same_page_address_block_read . . . . . . . . . . . . . . . . . . . . . . . . . . . 2083
C.117.72 same_page_address_block_write_TCC1 . . . . . . . . . . . . . . . . . . . . . . 2098
C.117.73 same_page_address_block_write . . . . . . . . . . . . . . . . . . . . . . . . . . 2099
C.117.74 split_linear_read_side_effects_states_TCC1 . . . . . . . . . . . . . . . . . . . . 2113
C.117.75 split_linear_read_side_effects_states . . . . . . . . . . . . . . . . . . . . . . . . 2114
C.117.76 split_linear_write_side_effects_states_TCC1 . . . . . . . . . . . . . . . . . . . . 2133
C.117.77 split_linear_write_side_effects_states . . . . . . . . . . . . . . . . . . . . . . . . 2134
C.117.78 split_linear_read_side_effects_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2155
C.117.79 split_linear_write_side_effects_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2178
C.117.80 split_linear_read_side_effects_data . . . . . . . . . . . . . . . . . . . . . . . . . 2202
C.117.81 split_linear_write_side_effects_data . . . . . . . . . . . . . . . . . . . . . . . . 2224
C.117.82 split_linear_read_side_effects_unchanged_memory . . . . . . . . . . . . . . . . 2250
C.117.83 split_linear_write_side_effects_unchanged_memory . . . . . . . . . . . . . . . . 2294
C.117.84 linear_unchanged_invariant . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2320
C.117.85 pm_phy_read_after_resolve_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2355
C.117.86 pm_phy_read_after_resolve_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . 2355
C.117.87 pm_resolve_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2355
C.117.88 pm_resolve_address_write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2358
C.118 Proofs for List_Split (linear_memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2361
C.118.1 split_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2361
C.118.2 split_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2361
C.118.3 split_pair_cross_size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2363
C.118.4 split_pair_concat. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2369
C.118.5 split_range. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2373
C.118.6 split_no_null. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2380
C.118.7 split_null. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2382
C.118.8 split_type_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2382
C.118.9 split_type_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2383
C.118.10 split_type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2383
C.119 Proofs for LogicalExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 2385
C.120 Proofs for LvalueToRvalueConversion (conversions.pvs) . . . . . . . . . . . . . . . . . . 2385
C.121 Proofs for Memory (memory.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.1 memory_write_list_nse_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.2 memory_write_list_nse_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.3 memory_read_list_nse_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.4 memory_read_list_nse_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.5 memory_read_list_ok_length . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.6 memory_read_transformers_memory_read. . . . . . . . . . . . . . . . . . . . 2387
C.121.7 memory_read_transformers_mono . . . . . . . . . . . . . . . . . . . . . . . . . 2388
C.121.8 memory_read_transformers_union . . . . . . . . . . . . . . . . . . . . . . . . . 2388
C.121.9 memory_write_transformers_memory_write . . . . . . . . . . . . . . . . . . . . 2388
C.121.10 memory_write_transformers_mono. . . . . . . . . . . . . . . . . . . . . . . . 2389
C.121.11 memory_read_side_effect_super_transformers_memory_read_side_effect . . . . . 2389
C.121.12 memory_read_side_effect_super_transformers_mono . . . . . . . . . . . . . . . 2389
C.121.13 memory_write_side_effect_super_transformers_memory_write_side_effect …. 2390
C.121.14 memory_write_side_effect_super_transformers_mono . . . . . . . . . . . . . . . 2390
C.121.15 side_effect_content_unchanged_content . . . . . . . . . . . . . . . . . . . . . . 2390
C.121.16 side_effect_content_unchanged_mono . . . . . . . . . . . . . . . . . . . . . . . 2391

471 C Proof scripts

C.121.17 side_effect_content_unchanged_composition . . . . . . . . . . . . . . . . . . . . 2391
C.122 Proofs for Memory_Change (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2393
C.122.1 unchanged_memory_invariant?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2393
C.122.2 unchanged_memory_invariant_unchanged_TCC1 . . . . . . . . . . . . . . . . . 2394
C.122.3 unchanged_memory_invariant_unchanged . . . . . . . . . . . . . . . . . . . . . 2394
C.122.4 unchanged_memory_invariant_invariant . . . . . . . . . . . . . . . . . . . . . . 2394
C.122.5 unchanged_memory_invariant_mono. . . . . . . . . . . . . . . . . . . . . . . 2395
C.122.6 unchanged_memory_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . . . . 2395
C.122.7 unchanged_memory_invariant_next_ok . . . . . . . . . . . . . . . . . . . . . . 2395
C.122.8 unchanged_memory_invariant_union_transformers . . . . . . . . . . . . . . . . 2396
C.122.9 unchanged_memory_invariant_union_addresses . . . . . . . . . . . . . . . . . . 2400
C.122.10 unchanged_memory_invariant_empty. . . . . . . . . . . . . . . . . . . . . . . 2401
C.122.11 unchanged_memory_invariant_all_transformers . . . . . . . . . . . . . . . . . . 2401
C.123 Proofs for Memory_Change_2 (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2402
C.123.1 unchanged_memory_write_invariant_mono_addresses . . . . . . . . . . . . . . 2402
C.123.2 unchanged_memory_write_invariant_transformer_invariant . . . . . . . . . . . 2403
C.123.3 unchanged_memory_write_invariant_unchanged_memory_invariant . . . . . . . 2404
C.123.4 unchanged_memory_invariant_union. . . . . . . . . . . . . . . . . . . . . . . 2408
C.123.5 transformer_invariant_write_list_nse . . . . . . . . . . . . . . . . . . . . . . . . 2409
C.123.6 transformer_invariant_write_list . . . . . . . . . . . . . . . . . . . . . . . . . . 2414
C.123.7 changed_memory_invariant?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2416
C.123.8 changed_memory_invariant_mono . . . . . . . . . . . . . . . . . . . . . . . . . 2416
C.123.9 memory_read_list_nse_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2418
C.123.10 memory_read_list_nse_next_length_TCC1 . . . . . . . . . . . . . . . . . . . . . 2422
C.123.11 memory_read_list_nse_next_length_TCC2 . . . . . . . . . . . . . . . . . . . . . 2422
C.123.12 memory_read_list_nse_next_length . . . . . . . . . . . . . . . . . . . . . . . . . 2422
C.123.13 memory_read_list_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2428
C.123.14 memory_read_list_next_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 2430
C.123.15 memory_read_list_next_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2430
C.123.16 unchanged_memory_read_list_nse_TCC1 . . . . . . . . . . . . . . . . . . . . . 2432
C.123.17 unchanged_memory_read_list_nse_TCC2 . . . . . . . . . . . . . . . . . . . . . 2433
C.123.18 unchanged_memory_read_list_nse_TCC3 . . . . . . . . . . . . . . . . . . . . . 2434
C.123.19 unchanged_memory_read_list_nse . . . . . . . . . . . . . . . . . . . . . . . . . 2435
C.123.20 unchanged_memory_read_list_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2450
C.123.21 unchanged_memory_read_list_TCC2 . . . . . . . . . . . . . . . . . . . . . . . 2451
C.123.22 unchanged_memory_read_list_TCC3 . . . . . . . . . . . . . . . . . . . . . . . 2451
C.123.23 unchanged_memory_read_list. . . . . . . . . . . . . . . . . . . . . . . . . . . 2452
C.123.24 unchanged_memory_invariant_unchanged_read_list_nse_TCC1 . . . . . . . . . 2457
C.123.25 unchanged_memory_invariant_unchanged_read_list_nse_TCC2 . . . . . . . . . 2458
C.123.26 unchanged_memory_invariant_unchanged_read_list_nse_TCC3 . . . . . . . . . 2459
C.123.27 unchanged_memory_invariant_unchanged_read_list_nse . . . . . . . . . . . . . 2459
C.123.28 memory_write_list_ok_nse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2466
C.123.29 memory_write_list_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2470
C.123.30 unchanged_memory_invariant_unchanged_write_list_nse_TCC1 . . . . . . . . . 2472
C.123.31 unchanged_memory_invariant_unchanged_write_list_nse_TCC2 . . . . . . . . . 2473
C.123.32 unchanged_memory_invariant_unchanged_write_list_nse_TCC3 . . . . . . . . . 2474
C.123.33 unchanged_memory_invariant_unchanged_write_list_nse . . . . . . . . . . . . . 2475
C.123.34 unchanged_memory_invariant_unchanged_write_list_TCC1 . . . . . . . . . . . 2484
C.123.35 unchanged_memory_invariant_unchanged_write_list_TCC2 . . . . . . . . . . . 2485
C.123.36 unchanged_memory_invariant_unchanged_write_list_TCC3 . . . . . . . . . . . 2488
C.123.37 unchanged_memory_invariant_unchanged_write_list . . . . . . . . . . . . . . . 2489
C.123.38 unchanged_memory_invariant_read_list . . . . . . . . . . . . . . . . . . . . . . 2493

472

Contents for Appendix C

C.123.39 unchanged_memory_read_list_write_list_nse_TCC1 . . . . . . . . . . . . . . . 2499
C.123.40 unchanged_memory_read_list_write_list_nse_TCC2 . . . . . . . . . . . . . . . 2500
C.123.41 unchanged_memory_read_list_write_list_nse . . . . . . . . . . . . . . . . . . . 2502
C.123.42 unchanged_memory_read_list_write_list_TCC1 . . . . . . . . . . . . . . . . . . 2538
C.123.43 unchanged_memory_read_list_write_list_TCC2 . . . . . . . . . . . . . . . . . . 2538
C.123.44 unchanged_memory_read_list_write_list . . . . . . . . . . . . . . . . . . . . . . 2545
C.124 Proofs for Memory_Change_3 (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2559
C.124.1 expr_unchanged_memory_invariant_unchanged_TCC1 . . . . . . . . . . . . . . 2559
C.124.2 expr_unchanged_memory_invariant_unchanged . . . . . . . . . . . . . . . . . . 2559
C.124.3 expr_unchanged_memory_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . 2560
C.124.4 expr_unchanged_memory_invariant_next_ok . . . . . . . . . . . . . . . . . . . 2560
C.125 Proofs for Memory_Change_4 (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2560
C.125.1 expr_unchanged_memory_invariant_composition . . . . . . . . . . . . . . . . . 2560
C.125.2 fexpr_unchanged_memory_invariant_composition . . . . . . . . . . . . . . . . 2571
C.126 Proofs for Memory_Physical_Memory (physical_memory.pvs) . . . . . . . . . . . . . . . 2579
C.127 Proofs for Memory_access (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2579
C.128 Proofs for Memory_access_adt (Memory_access_adt.pvs) . . . . . . . . . . . . . . . . . . 2579
C.129 Proofs for Memory_access_adt_reduce (Memory_access_adt.pvs) . . . . . . . . . . . . . 2579
C.130 Proofs for Memory_access_util (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 2579
C.131 Proofs for Memory_privilege (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.132 Proofs for Memory_privilege_adt (Memory_privilege_adt.pvs) . . . . . . . . . . . . . . . 2580
C.133 Proofs for Memory_privilege_adt_reduce (Memory_privilege_adt.pvs) . . . . . . . . . . . 2580
C.134 Proofs for Memory_privilege_util (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2580
C.134.1 bool_to_memory_privilege_iso . . . . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.135 Proofs for Min_Max_Extension (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . 2580
C.135.1 max_stable_under_extension_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.135.2 max_stable_under_extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.135.3 min_stable_under_extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2581
C.136 Proofs for More_Divides (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2582
C.136.1 expt_divides. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2582
C.136.2 divides_expt_gt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2582
C.137 Proofs for More_Function (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . 2583
C.137.1 restrict_to_image_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.137.2 surjective_restrict_to_image. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.137.3 bijective_restrict_to_image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.138 Proofs for More_List_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . 2583
C.138.1 length_is_cons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.138.2 cons_length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.3 length_cdr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.4 length_cdr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.5 conslist_induction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.6 head_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.7 head_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.8 head_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.9 head_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.10 length_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2587
C.138.11 length_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2588
C.138.12 nth_head_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2589
C.138.13 nth_head_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2590
C.138.14 nth_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2590
C.138.15 nth_tail_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2591
C.138.16 nth_tail_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2591

473 C Proof scripts

C.138.17 nth_tail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2591
C.138.18 car_head_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.19 car_head_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.20 car_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.21 cons_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.22 car_tail_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2594
C.138.23 car_tail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2594
C.138.24 cdr_tail_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2595
C.138.25 cdr_tail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2595
C.138.26 every_implied . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2597
C.138.27 every_conjunct_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2598
C.138.28 every_iff_forall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2598
C.138.29 some_iff_exists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2599
C.138.30 list_extensionality_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2601
C.138.31 list_extensionality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2601
C.138.32 list_remove_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.33 list_remove_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.34 list_remove_commutative. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.35 member_list_remove. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.36 nth_member. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2605
C.138.37 flatten_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2607
C.138.38 member_append . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2607
C.138.39 member_flatten. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2607
C.138.40 map2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2609
C.138.41 map2_property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2609
C.139 Proofs for More_List_Props_2 (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . 2610
C.139.1 member_map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2610
C.140 Proofs for More_More_List_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . 2611
C.140.1 list_all_length. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2611
C.141 Proofs for More_Relations (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . 2612
C.141.1 zorn_lr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2612
C.142 Proofs for More_Sets_Lemmas (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . 2613
C.142.1 subset_equal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.2 union_subset3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.3 subset_bigger_union_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.4 subset_bigger_union_right. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.5 union_empty_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.6 union_left . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.7 union_right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.8 subset_of_differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.9 difference_disjoint_3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.10 subset_singleton. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.11 subset_member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.12 disjoint_symmetric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.13 disjoint_mono. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.142.14 disjoint_subset_difference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.143 Proofs for Number_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . 2616
C.143.1 number_split . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.143.2 number_split_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.143.3 bit_split_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2617
C.143.4 rem_def_pos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2617
C.143.5 rem_rem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2618

474

Contents for Appendix C

C.143.6 divides_times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2619
C.143.7 ndiv_floor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2621
C.143.8 ndiv_self. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2621
C.143.9 ndiv_plus_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2622
C.143.10 ndiv_plus_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2623
C.143.11 ndiv_plus_mod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2623
C.143.12 ndiv_plus_mod_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2624
C.143.13 ndiv_minus_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2625
C.143.14 ndiv_times_divident_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2627
C.143.15 ndiv_times_divident_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2629
C.143.16 rem_prod_3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2629
C.143.17 ndiv_times_2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2632
C.143.18 both_sides_ndiv_lt1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2632
C.143.19 rem_ndiv . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2633
C.143.20 mod_rem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2634
C.143.21 ndiv_rem_divisible_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2635
C.143.22 ndiv_rem_divisible. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2635
C.143.23 expt_2_8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2637
C.143.24 ndiv_0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2637
C.143.25 ndiv_1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2637
C.143.26 ndiv_bigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2638
C.143.27 ndiv_reduce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2638
C.143.28 ndiv_expt_expt_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2639
C.143.29 ndiv_expt_expt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2639
C.143.30 min_plus1_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2641
C.143.31 min_plus1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2642
C.143.32 min_member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2643
C.144 Proofs for Ok_Result_Rewrite (state-transformer.pvs). . . . . . . . . . . . . . . . . . . 2644
C.144.1 ok_result_q_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.2 ok_result_q_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.3 ok_result_q_state_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.4 ok_result_q_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.5 ok_result_q_data_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2645
C.144.6 ok_result_q_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2645
C.144.7 ok_result_elemination_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2645
C.145 Proofs for PDBR_Data_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . 2646
C.145.1 pdbr_valid?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.2 pdbr_valid?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.3 pdbr_to_byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.4 pdbr_to_byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.5 pdbr_to_byte_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2647
C.145.6 pdbr_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2647
C.145.7 pdbr_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2648
C.145.8 pdbr_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2648
C.145.9 pdbr_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2648
C.145.10 pdbr_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2650
C.145.11 pdbr_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2650
C.145.12 pdbr_valid_to_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2650
C.145.13 pdbr_is_pod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2651
C.146 Proofs for PDBR_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2653
C.146.1 pdbr_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2653
C.147 Proofs for PDBR_Type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2654

475 C Proof scripts

C.147.1 Pdbr_type_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.148 Proofs for PDE_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.148.1 pde_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.149 Proofs for PDE_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . . . 2654
C.149.1 pde_valid?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.149.2 pde_valid?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.149.3 pde_valid?_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2655
C.149.4 pde_pte_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2655
C.149.5 pde_pte_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2655
C.149.6 pde_pte_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2656
C.149.7 pde_super_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2656
C.149.8 pde_super_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2657
C.149.9 pde_super_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2657
C.149.10 pde_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2658
C.149.11 pde_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.12 pde_4m_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.13 pde_4m_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.14 pde_4m_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.15 pde_4m_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2660
C.149.16 pde_4m_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2660
C.149.17 pde_4m_from_byte_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2660
C.149.18 pde_4k_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2661
C.149.19 pde_4k_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2662
C.149.20 pde_4k_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2662
C.149.21 pde_4k_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2662
C.149.22 pde_4k_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2663
C.149.23 pde_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2665
C.149.24 pde_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2665
C.149.25 pde_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2665
C.149.26 pde_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2666
C.149.27 pde_is_pod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2666
C.150 Proofs for PF_EC_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . 2671
C.150.1 pf_ec_valid?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2671
C.150.2 pf_ec_valid?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.3 pf_ec_valid?_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.4 pf_ec_valid?_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.5 pf_ec_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.6 pf_ec_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2673
C.150.7 pf_ec_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2673
C.150.8 pf_ec_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.150.9 pf_ec_model_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.150.10 pf_ec_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.150.11 pf_ec_is_pod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.151 Proofs for PF_Error_Code_Type (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . 2676
C.151.1 pf_ec_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2676
C.152 Proofs for PTE_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2676
C.152.1 pte_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2676
C.153 Proofs for PTE_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . . . 2677
C.153.1 pte_page_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2677
C.153.2 pte_page_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2677
C.153.3 pte_page_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2678
C.153.4 pte_to_byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2678

476

Contents for Appendix C

C.153.5 pte_to_byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2678
C.153.6 pte_page_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.7 pte_page_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.8 pte_page_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.9 pte_page_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.10 pte_page_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2680
C.153.11 pte_page_from_byte_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2680
C.153.12 pte_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.153.13 pte_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.153.14 pte_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.153.15 pte_is_pod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.154 Proofs for Page_Directory_Types (paging-data.pvs). . . . . . . . . . . . . . . . . . . . 2686
C.154.1 Pde_pt_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155 Proofs for Paging_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155.1 paging_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155.2 paging_data_type_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155.3 paging_data_type_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2687
C.155.4 paging_data_type_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2691
C.155.5 paging_data_type_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2691
C.155.6 paging_data_type_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2691
C.155.7 paging_data_type_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2693
C.156 Proofs for Paging_type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2693
C.157 Proofs for Paging_type_adt (Paging_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . 2693
C.158 Proofs for Paging_type_adt_reduce (Paging_type_adt.pvs) . . . . . . . . . . . . . . . . . 2693
C.159 Proofs for Paging_type_helpers (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . 2694
C.159.1 range_pt_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.2 base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.3 base_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.4 set_reference_range. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.5 set_reference_pdir_entry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.6 set_reference_ptab_entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2695
C.159.7 set_reference_paging_type. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2695
C.159.8 set_reference_present. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2696
C.159.9 set_reference_base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2698
C.159.10 set_reference_base. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2699
C.159.11 set_reference_accessible. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2703
C.159.12 set_reference_privileged . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2713
C.159.13 set_reference_leaf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2724
C.160 Proofs for Pde_type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2726
C.161 Proofs for Pde_type_adt (Pde_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2726
C.161.1 Pde_4m_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2726
C.162 Proofs for Pde_type_adt_reduce (Pde_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . 2726
C.163 Proofs for Phy_Mem_Blessing (challenge-phymem.pvs). . . . . . . . . . . . . . . . . . 2727
C.163.1 phy_mem_plain_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2727
C.164 Proofs for Phy_Mem_Blessing_Data (challenge-phymem.pvs). . . . . . . . . . . . . . . 2731
C.164.1 in_memory_blessed_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2731
C.165 Proofs for Phy_Mem_Challenge_Read_Other (challenge-phymem.pvs) . . . . . . . . . . 2731
C.165.1 read_write_other_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2731
C.165.2 read_write_other_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2732
C.165.3 read_write_other_res_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2732
C.165.4 read_write_other_res. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2733
C.165.5 read_read_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2733

477 C Proof scripts

C.165.6 read_read_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2734
C.165.7 read_read_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2734
C.165.8 read_read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2735
C.166 Proofs for Phy_Mem_Challenge_Read_Same (challenge-phymem.pvs) . . . . . . . . . . . 2735
C.166.1 read_write_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2735
C.166.2 read_write_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2736
C.166.3 read_write_res. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2736
C.167 Proofs for Phy_Mem_Properties (challenge-phymem.pvs). . . . . . . . . . . . . . . . . 2737
C.167.1 min_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2737
C.167.2 phy_mem_write_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2737
C.167.3 phy_mem_read_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2737
C.167.4 phy_mem_read_side_effects_transformers_ok . . . . . . . . . . . . . . . . . . . 2737
C.167.5 phy_mem_write_side_effects_transformers_ok . . . . . . . . . . . . . . . . . . . 2738
C.167.6 phy_mem_unchanged_memory_invariant_read_transformers . . . . . . . . . . . 2738
C.167.7 phy_mem_unchanged_memory_invariant_read_side_effect_transformers . . . . . 2739
C.167.8 phy_mem_unchanged_memory_invariant_write_side_effect_transformers …. 2740
C.167.9 phy_mem_unchanged_memory_write_invariant . . . . . . . . . . . . . . . . . . 2741
C.167.10 phy_mem_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . . . . 2742
C.168 Proofs for Physical_Memory (physical_memory.pvs). . . . . . . . . . . . . . . . . . . . 2742
C.169 Proofs for Physical_Memory_Corollaries (physical_memory.pvs) . . . . . . . . . . . . . . 2743
C.169.1 physical_read_ok_next_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.2 physical_read_ok_next_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.3 physical_write_ok_next_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.4 physical_write_ok_next_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.5 physical_read_ok_get_data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2744
C.170 Proofs for Physical_Memory_Properties (physical_memory.pvs) . . . . . . . . . . . . . . 2744
C.170.1 physical_read_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2744
C.170.2 physical_write_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2744
C.171 Proofs for Plain_Mem_Properties (plain_memory.pvs) . . . . . . . . . . . . . . . . . . . 2745
C.171.1 plain_mem_write_list_read_list_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2745
C.171.2 plain_mem_write_list_read_list . . . . . . . . . . . . . . . . . . . . . . . . . . . 2745
C.171.3 plain_mem_q_read_list_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2746
C.171.4 plain_mem_q_read_list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2746
C.172 Proofs for Plain_Mem_Properties_2 (plain_memory.pvs) . . . . . . . . . . . . . . . . . . 2746
C.172.1 plain_memory_inv_pred_write_data_TCC1 . . . . . . . . . . . . . . . . . . . . 2746
C.172.2 plain_memory_inv_pred_write_data . . . . . . . . . . . . . . . . . . . . . . . . 2747
C.172.3 plain_memory_read_data_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2747
C.172.4 plain_memory_write_data_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . 2749
C.172.5 plain_memory_write_data_valid_TCC1 . . . . . . . . . . . . . . . . . . . . . . 2750
C.172.6 plain_memory_write_data_valid . . . . . . . . . . . . . . . . . . . . . . . . . . 2751
C.172.7 plain_memory_transformers_ok_write_data . . . . . . . . . . . . . . . . . . . . 2752
C.172.8 plain_memory_transformer_invariant_write_data . . . . . . . . . . . . . . . . . 2753
C.172.9 plain_memory_transformer_invariant_read_data . . . . . . . . . . . . . . . . . 2754
C.172.10 plain_memory_unchanged_memory_invariant_write_data . . . . . . . . . . . . 2755
C.172.11 plain_memory_unchanged_memory_invariant_read_data . . . . . . . . . . . . . 2761
C.172.12 plain_memory_read_data_q_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2764
C.172.13 plain_memory_read_data_q_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . 2764
C.172.14 plain_memory_read_data_q_same_TCC1 . . . . . . . . . . . . . . . . . . . . . 2768
C.172.15 plain_memory_read_data_q_same_TCC2 . . . . . . . . . . . . . . . . . . . . . 2768
C.172.16 plain_memory_read_data_q_same . . . . . . . . . . . . . . . . . . . . . . . . . 2768
C.172.17 plain_memory_read_write_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2769
C.172.18 plain_memory_read_write_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2770

478

Contents for Appendix C

C.172.19 plain_memory_read_write_res . . . . . . . . . . . . . . . . . . . . . . . . . . . 2771
C.172.20 plain_memory_unchanged_memory_ok_result . . . . . . . . . . . . . . . . . . . 2773
C.173 Proofs for Plain_Mem_Properties_3 (plain_memory.pvs) . . . . . . . . . . . . . . . . . . 2775
C.173.1 plain_memory_read_write_other_ok . . . . . . . . . . . . . . . . . . . . . . . . 2775
C.173.2 plain_memory_read_write_other_res_TCC1 . . . . . . . . . . . . . . . . . . . . 2776
C.173.3 plain_memory_read_write_other_res_TCC2 . . . . . . . . . . . . . . . . . . . . 2777
C.173.4 plain_memory_read_write_other_res . . . . . . . . . . . . . . . . . . . . . . . . 2777
C.173.5 plain_memory_read_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2778
C.173.6 plain_memory_read_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 2781
C.173.7 plain_memory_read_read_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 2781
C.173.8 plain_memory_read_read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2782
C.173.9 plain_memory_unchanged_composition . . . . . . . . . . . . . . . . . . . . . . 2783
C.174 Proofs for Plain_Mem_Rewrites (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . . 2785
C.175 Proofs for Plain_Mem_Rewrites1 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2785
C.175.1 pm_q_prop_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2785
C.175.2 pm_q_prop_ok_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2785
C.176 Proofs for Plain_Mem_Rewrites2 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2786
C.176.1 in_blessed_memory_rw_ro . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2786
C.176.2 pm_q_prop_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2786
C.176.3 pm_q_prop_ok_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2786
C.176.4 pm_q_prop_single_read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2787
C.176.5 pm_q_prop_ok_result_single . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2787
C.176.6 plain_memory_write_ok_single . . . . . . . . . . . . . . . . . . . . . . . . . . . 2787
C.176.7 pm_q_prop_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2788
C.177 Proofs for Plain_Mem_Rewrites3 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2788
C.177.1 pm_q_prop_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2788
C.178 Proofs for Plain_Mem_Rewrites4 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2788
C.178.1 plain_memory_write_ok_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . 2788
C.178.2 pm_q_prop_read_ok_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2789
C.178.3 pm_q_prop_read_pm_q_prop_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2789
C.178.4 pm_q_prop_read_write_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 2790
C.178.5 pm_q_prop_ok_result_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2790
C.178.6 pm_q_prop_read_ok_result_single . . . . . . . . . . . . . . . . . . . . . . . . . 2790
C.178.7 plain_memory_read_write_q_data_expr_TCC1 . . . . . . . . . . . . . . . . . . 2791
C.178.8 plain_memory_read_write_q_data_expr . . . . . . . . . . . . . . . . . . . . . . 2791
C.178.9 pm_q_prop_read_write_other_single . . . . . . . . . . . . . . . . . . . . . . . . 2792
C.178.10 pm_q_prop_read_read_single . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2792
C.179 Proofs for Plain_Mem_Rewrites5 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2793
C.179.1 plain_memory_write_ok_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . 2793
C.179.2 pm_q_prop_read_ok_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2793
C.179.3 pm_q_prop_read_pm_q_prop_stmt . . . . . . . . . . . . . . . . . . . . . . . . . 2794
C.179.4 pm_q_prop_read_write_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . 2795
C.179.5 pm_q_prop_ok_result_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2795
C.179.6 plain_memory_read_write_q_data_stmt_TCC1 . . . . . . . . . . . . . . . . . . 2796
C.179.7 plain_memory_read_write_q_data_stmt . . . . . . . . . . . . . . . . . . . . . . 2796
C.179.8 pm_q_prop_single_write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2797
C.179.9 pm_q_prop_read_write_single . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2797
C.179.10 pm_q_prop_e2s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2797
C.179.11 pm_q_prop_stmt_e2s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2798
C.180 Proofs for Plain_Mem_Rewrites6 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2798
C.180.1 pm_q_prop_read_write_other_q_expr . . . . . . . . . . . . . . . . . . . . . . . . 2798
C.180.2 pm_q_prop_read_read_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 2799

479 C Proof scripts

C.180.3 pm_q_prop_read_ok_result_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2801
C.180.4 plain_memory_read_read_q_data_expr_TCC1 . . . . . . . . . . . . . . . . . . . 2801
C.180.5 plain_memory_read_read_q_data_expr_TCC2 . . . . . . . . . . . . . . . . . . . 2801
C.180.6 plain_memory_read_read_q_data_expr . . . . . . . . . . . . . . . . . . . . . . . 2802
C.181 Proofs for Plain_Mem_Rewrites7 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2802
C.181.1 pm_q_prop_read_write_other_q_stmt . . . . . . . . . . . . . . . . . . . . . . . 2802
C.181.2 plain_memory_read_write_other_single_data_TCC1 . . . . . . . . . . . . . . . 2804
C.181.3 plain_memory_read_write_other_single_data_TCC2 . . . . . . . . . . . . . . . 2805
C.181.4 plain_memory_read_write_other_single_data . . . . . . . . . . . . . . . . . . . 2806
C.181.5 pm_q_prop_read_read_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . 2807
C.181.6 pm_q_prop_read_ok_result_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . 2807
C.181.7 plain_memory_read_write_other_q_data_stmt_TCC1 . . . . . . . . . . . . . . . 2808
C.181.8 plain_memory_read_write_other_q_data_stmt_TCC2 . . . . . . . . . . . . . . . 2808
C.181.9 plain_memory_read_write_other_q_data_stmt . . . . . . . . . . . . . . . . . . . 2809
C.181.10 plain_memory_read_read_q_data_stmt_TCC1 . . . . . . . . . . . . . . . . . . . 2809
C.181.11 plain_memory_read_read_q_data_stmt_TCC2 . . . . . . . . . . . . . . . . . . . 2810
C.181.12 plain_memory_read_read_q_data_stmt . . . . . . . . . . . . . . . . . . . . . . . 2810
C.181.13 pm_q_prop_read_e2s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2811
C.181.14 pm_q_prop_read_stmt_e2s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2811
C.182 Proofs for Plain_Mem_Rewrites8 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2812
C.182.1 plain_memory_read_write_other_q_data_expr_TCC1 . . . . . . . . . . . . . . . 2812
C.182.2 plain_memory_read_write_other_q_data_expr_TCC2 . . . . . . . . . . . . . . . 2812
C.182.3 plain_memory_read_write_other_q_data_expr . . . . . . . . . . . . . . . . . . . 2813
C.183 Proofs for Plain_Memory (plain_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2814
C.183.1 plain_memory_invariant_read_transformers_ro_addr . . . . . . . . . . . . . . . 2814
C.183.2 plain_memory_invariant_read_transformers_rw_addr . . . . . . . . . . . . . . . 2814
C.183.3 plain_memory_invariant_read_transformers_ro_rw_addr . . . . . . . . . . . . . 2814
C.183.4 plain_memory_invariant_write_transformers_rw_addr . . . . . . . . . . . . . . 2815
C.183.5 plain_memory_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2815
C.183.6 plain_memory_unchanged_invariant . . . . . . . . . . . . . . . . . . . . . . . . 2816
C.183.7 plain_memory_unchanged_memory_invariant_write . . . . . . . . . . . . . . . 2817
C.183.8 plain_memory_unchanged_memory_write_invariant . . . . . . . . . . . . . . . 2817
C.183.9 plain_memory_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . 2817
C.183.10 plain_memory_invariant_read_block . . . . . . . . . . . . . . . . . . . . . . . . 2818
C.183.11 plain_memory_invariant_write_block . . . . . . . . . . . . . . . . . . . . . . . 2818
C.183.12 plain_memory_transformer_invariant_read_side_effects . . . . . . . . . . . . . . 2818
C.183.13 plain_memory_transformer_invariant_write_side_effects . . . . . . . . . . . . . 2820
C.183.14 plain_memory_transformer_invariant_read_list_block . . . . . . . . . . . . . . . 2821
C.183.15 plain_memory_transformer_invariant_write_list_block . . . . . . . . . . . . . . 2821
C.183.16 plain_memory_transformers_ok_read_ro_rw . . . . . . . . . . . . . . . . . . . . 2821
C.183.17 plain_memory_transformers_ok_read_block . . . . . . . . . . . . . . . . . . . . 2822
C.183.18 plain_memory_transformers_ok_write_rw . . . . . . . . . . . . . . . . . . . . . 2823
C.183.19 plain_memory_transformers_ok_write_block . . . . . . . . . . . . . . . . . . . 2823
C.183.20 plain_memory_transformers_ok_read_side_effects_ro_rw . . . . . . . . . . . . . 2824
C.183.21 plain_memory_transformers_ok_read_side_effects_block . . . . . . . . . . . . . 2824
C.183.22 plain_memory_transformers_ok_write_side_effects_ro_rw . . . . . . . . . . . . . 2825
C.183.23 plain_memory_transformers_ok_write_side_effects_block . . . . . . . . . . . . . 2825
C.183.24 plain_memory_transformers_ok_read_list_block . . . . . . . . . . . . . . . . . . 2826
C.183.25 plain_memory_transformers_ok_write_list_block . . . . . . . . . . . . . . . . . 2826
C.183.26 plain_memory_unchanged_read_block_rw_addr . . . . . . . . . . . . . . . . . . 2826
C.183.27 plain_memory_unchanged_read_ro_rw_addr . . . . . . . . . . . . . . . . . . . . 2827
C.183.28 plain_memory_unchanged_read_block_ro_rw_addr . . . . . . . . . . . . . . . . 2827

480

Contents for Appendix C

C.183.29 plain_memory_unchanged_write_block_ro_addr . . . . . . . . . . . . . . . . . . 2828
C.183.30 plain_memory_unchanged_read_block . . . . . . . . . . . . . . . . . . . . . . . 2828
C.183.31 plain_memory_unchanged_read_side_effect_block_ro_rw . . . . . . . . . . . . . 2829
C.183.32 plain_memory_unchanged_read_side_effect_block . . . . . . . . . . . . . . . . . 2829
C.183.33 plain_memory_unchanged_write_side_effect_block_ro_rw . . . . . . . . . . . . . 2830
C.183.34 plain_memory_unchanged_write_side_effect_block . . . . . . . . . . . . . . . . 2830
C.183.35 plain_memory_unchanged_block . . . . . . . . . . . . . . . . . . . . . . . . . . 2831
C.183.36 plain_memory_changed_block. . . . . . . . . . . . . . . . . . . . . . . . . . . 2831
C.183.37 plain_memory_side_effect_content_unchanged_read_block . . . . . . . . . . . . 2832
C.183.38 plain_memory_side_effect_content_unchanged_write_block . . . . . . . . . . . . 2832
C.183.39 plain_memory_memory_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2832
C.183.40 plain_memory_states_memory_read_TCC1 . . . . . . . . . . . . . . . . . . . . 2833
C.183.41 plain_memory_states_memory_read . . . . . . . . . . . . . . . . . . . . . . . . 2833
C.183.42 plain_memory_memory_read_memory_read_TCC1 . . . . . . . . . . . . . . . . 2833
C.183.43 plain_memory_memory_read_memory_read_TCC2 . . . . . . . . . . . . . . . . 2834
C.183.44 plain_memory_memory_read_memory_read_TCC3 . . . . . . . . . . . . . . . . 2834
C.183.45 plain_memory_memory_read_memory_read . . . . . . . . . . . . . . . . . . . . 2835
C.183.46 plain_memory_memory_write_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2835
C.183.47 plain_memory_states_memory_write_TCC1 . . . . . . . . . . . . . . . . . . . . 2835
C.183.48 plain_memory_states_memory_write . . . . . . . . . . . . . . . . . . . . . . . . 2836
C.183.49 plain_memory_memory_read_memory_write_other_TCC1 . . . . . . . . . . . . 2836
C.183.50 plain_memory_memory_read_memory_write_other_TCC2 . . . . . . . . . . . . 2837
C.183.51 plain_memory_memory_read_memory_write_other_TCC3 . . . . . . . . . . . . 2837
C.183.52 plain_memory_memory_read_memory_write_other . . . . . . . . . . . . . . . . 2837
C.183.53 stays_unchanged_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2839
C.183.54 stays_unchanged_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2839
C.183.55 stays_unchanged_unchanged_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2839
C.183.56 stays_unchanged_unchanged_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . 2840
C.183.57 stays_unchanged_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2840
C.183.58 stays_unchanged_symmetric. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2840
C.183.59 stays_unchanged_mono. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2841
C.183.60 stays_unchanged_only_changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 2841
C.183.61 stays_unchanged_only_changes_disjoint . . . . . . . . . . . . . . . . . . . . . . 2842
C.183.62 only_changes_symmetric. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2843
C.183.63 only_changes_mono. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2843
C.183.64 only_changes_unchanged_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 2844
C.183.65 only_changes_unchanged_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 2844
C.183.66 only_changes_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2844
C.183.67 plain_memory_stays_unchanged_memory_read_TCC1 . . . . . . . . . . . . . . 2845
C.183.68 plain_memory_stays_unchanged_memory_read . . . . . . . . . . . . . . . . . . 2845
C.183.69 plain_memory_stays_unchanged_memory_write_TCC1 . . . . . . . . . . . . . . 2846
C.183.70 plain_memory_stays_unchanged_memory_write . . . . . . . . . . . . . . . . . 2846
C.184 Proofs for PointerToMemberExpressions (expressions.pvs) . . . . . . . . . . . . . . . . 2846
C.184.1 ptm_member_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2846
C.184.2 ptm_arrow_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2847
C.185 Proofs for Posnat_induction (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . 2855
C.185.1 posnat_induction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2855
C.186 Proofs for PostfixExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2856
C.186.1 postinc_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2856
C.186.2 postinc_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2857
C.186.3 postinc_float_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2857
C.186.4 postinc_float_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858

481 C Proof scripts

C.187 Proofs for PrimaryExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 2858
C.188 Proofs for Pte_type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.189 Proofs for Pte_type_adt (Pte_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.189.1 Pte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.190 Proofs for Pte_type_adt_reduce (Pte_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . 2858
C.191 Proofs for Random_Device (random_device.pvs). . . . . . . . . . . . . . . . . . . . . . 2858
C.191.1 base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.191.2 rnd_seed_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2859
C.191.3 mem_cnt_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2859
C.191.4 rnd_val_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2860
C.191.5 increase_access_count_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2860
C.191.6 clear_counter_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2860
C.191.7 random_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2861
C.191.8 read_mem_cnt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2861
C.191.9 read_mem_cnt_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2861
C.191.10 read_mem_cnt_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2862
C.191.11 read_seed_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2864
C.191.12 read_seed_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2864
C.191.13 read_seed_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2865
C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs) . . . . . . . . . . . . . . . . . 2869
C.192.1 plain_mem_write_list_states_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2869
C.192.2 plain_mem_write_list_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2869
C.192.3 plain_mem_write_list_read_list_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2871
C.192.4 Fatal_Result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2872
C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs) . . . . . . . . . . . . . . . . 2873
C.193.1 plain_mem_write_list_states_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2873
C.193.2 plain_mem_write_list_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2873
C.193.3 plain_mem_write_list_read_list_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2875
C.193.4 Fatal_Result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2876
C.194 Proofs for Register_Id (constants.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2877
C.195 Proofs for Register_Id_adt (Register_Id_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . 2877
C.196 Proofs for Register_Id_adt_reduce (Register_Id_adt.pvs) . . . . . . . . . . . . . . . . . . 2878
C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs). . . . . . . . . . . . . . . . . . . 2878
C.197.1 rewrite_test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2878
C.197.2 rewrite_test_data_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2878
C.197.3 rewrite_test_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2879
C.197.4 rewrite_test_data_long_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2880
C.197.5 rewrite_test_data_long. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2882
C.197.6 rewrite_test_data_eval_if_ok_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2884
C.197.7 rewrite_test_data_eval_if_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2885
C.197.8 rewrite_test_data_eval_if_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2885
C.197.9 rewrite_test_data_eval_if_ok_ok_result_ok . . . . . . . . . . . . . . . . . . . . . 2886
C.197.10 rewrite_test_data_eval_if_ok_ok_result_TCC1 . . . . . . . . . . . . . . . . . . . 2887
C.197.11 rewrite_test_data_eval_if_ok_ok_result . . . . . . . . . . . . . . . . . . . . . . . 2887
C.198 Proofs for Search_Example (search-example.pvs). . . . . . . . . . . . . . . . . . . . . . 2888
C.198.1 value_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2888
C.198.2 Search_Pre_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2889
C.198.3 Search_Pre_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2889
C.198.4 Search_Pre_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2892
C.198.5 Search_Pre_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2893
C.198.6 Search_Pre_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2893
C.198.7 Search_Pre_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2894

482

Contents for Appendix C

C.198.8 Search_Pre_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2895
C.198.9 Search_Pre_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2895
C.198.10 Search_Pre_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2896
C.198.11 search_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2898
C.198.12 search_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2900
C.198.13 search_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2901
C.198.14 search_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2901
C.198.15 deref_current_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2903
C.198.16 deref_current_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2904
C.198.17 read_array_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2904
C.198.18 read_array_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2904
C.198.19 read_array_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2905
C.198.20 not_found_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2905
C.198.21 not_found_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2905
C.198.22 not_found_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2906
C.198.23 not_found_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2906
C.198.24 found_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2907
C.198.25 found_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2907
C.198.26 found_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2908
C.198.27 uchar_range_values_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2909
C.198.28 uchar_range_values. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2910
C.198.29 search_terminates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2910
C.198.30 search_read_first. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2912
C.198.31 search_read_current. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2914
C.198.32 search_deref_current. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2915
C.198.33 search_read_last. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2917
C.198.34 search_read_array. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2919
C.198.35 search_not_found. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2921
C.198.36 search_found . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2922
C.199 Proofs for Segment_Reg_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . 2924
C.199.1 segment_selector_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2924
C.199.2 segment_reg_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2924
C.200 Proofs for Segment_Types (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.201 Proofs for SelectionStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . 2925
C.202 Proofs for Set_Lift (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs). . . . . . . . . . . . . 2925
C.203.1 break_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.203.2 break_break_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.203.3 break_break_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.4 break_break_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.5 break_break_lift_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.6 break_break_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.7 break_break_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.8 break_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.9 stmt_break_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.10 break_stmt_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.11 break_stmt_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.12 break_stmt_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.13 break_stmt_lift. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.14 break_stmt_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.15 break_stmt_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.16 continue_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2929

483 C Proof scripts

C.203.17 continue_break_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2929
C.203.18 continue_break_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . 2929
C.203.19 continue_break_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . 2929
C.203.20 continue_break_lift_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.21 continue_break_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.22 continue_break_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.23 continue_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.24 stmt_continue_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.25 continue_stmt_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.26 continue_stmt_catch_break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.27 continue_stmt_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.28 continue_stmt_lift. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.29 continue_stmt_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.30 continue_stmt_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.31 switch_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.32 stmt_switch_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.33 switch_case_taken. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.34 stmt_switch_case_taken . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.35 switch_case_not_taken. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.36 stmt_switch_case_not_taken . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.37 switch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2934
C.203.38 stmt_switch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2934
C.203.39 switch_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2934
C.203.40 stmt_switch_catch_break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.41 switch_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.42 stmt_switch_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.43 switch_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.44 stmt_switch_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.45 default_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.46 stmt_default_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.47 default_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.48 stmt_default_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.49 default_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.50 stmt_default_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.51 default_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.52 stmt_default_catch_break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.53 default_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.54 stmt_default_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.55 default_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.56 stmt_default_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.57 return_void_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.58 skip_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.59 skip_state_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.60 skip_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.61 skip_elemination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.62 stmt_skip_elemination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.63 stmt_remove_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.64 stmt_remove_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.65 stmt_remove_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.66 stmt_remove_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.67 stmt_remove_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.68 stmt_ok_lift. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941

484

Contents for Appendix C

C.203.69 while_unroll_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2942
C.203.70 while_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2942
C.203.71 stmt_while_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2942
C.203.72 iterate_while_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2943
C.203.73 while_hang . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2945
C.203.74 composition_assoc_rewrite_stmt_ok . . . . . . . . . . . . . . . . . . . . . . . . 2946
C.203.75 composition_assoc_rewrite_stmt_ok_cstmt . . . . . . . . . . . . . . . . . . . . 2947
C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs). . . . . . . . . . . . . 2947
C.204.1 forward_s_c_s_of_s_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2947
C.204.2 stmt_ok_lift_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2947
C.204.3 break_break_stmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2947
C.204.4 break_break_catch_continue_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2948
C.204.5 break_break_catch_default_expr . . . . . . . . . . . . . . . . . . . . . . . . . . 2948
C.204.6 break_break_lift_stmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2948
C.204.7 break_break_case_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.8 break_break_default_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.9 continue_break_stmt_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.10 continue_break_catch_continue_expr . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.11 continue_break_catch_default_expr . . . . . . . . . . . . . . . . . . . . . . . . 2950
C.204.12 continue_break_lift_stmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 2950
C.204.13 continue_break_case_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2950
C.204.14 continue_break_default_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2951
C.204.15 while_unroll_expr_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2951
C.204.16 while_unroll_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2951
C.204.17 while_unroll_lexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2952
C.204.18 stmt_while_unroll_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2952
C.204.19 stmt_while_unroll_lexpr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2953
C.204.20 e2s_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2953
C.204.21 stmt_e2s_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2954
C.204.22 e2s_state_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2954
C.204.23 e2s_state_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2954
C.204.24 e2s_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2955
C.204.25 stmt_e2s_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2955
C.204.26 stmt_e2s_state_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2955
C.204.27 stmt_e2s_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.28 comp_eval_if_ok_fstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.29 stmt_eval_if_ok_fstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.30 comp_eval_if_ok_fstmt_cstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.31 stmt_eval_if_ok_fstmt_cstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2957
C.204.32 composition_assoc_rewrite_expr_1 . . . . . . . . . . . . . . . . . . . . . . . . . 2957
C.204.33 composition_assoc_rewrite_expr_2 . . . . . . . . . . . . . . . . . . . . . . . . . 2957
C.204.34 composition_assoc_rewrite_expr_3 . . . . . . . . . . . . . . . . . . . . . . . . . 2958
C.204.35 composition_assoc_rewrite_expr_4 . . . . . . . . . . . . . . . . . . . . . . . . . 2958
C.204.36 composition_assoc_rewrite_expr_5 . . . . . . . . . . . . . . . . . . . . . . . . . 2958
C.204.37 composition_assoc_rewrite_expr_6 . . . . . . . . . . . . . . . . . . . . . . . . . 2959
C.204.38 composition_assoc_rewrite_stmt_ok . . . . . . . . . . . . . . . . . . . . . . . . 2959
C.204.39 composition_assoc_rewrite_stmt_ok_expr . . . . . . . . . . . . . . . . . . . . . 2959
C.204.40 composition_assoc_rewrite_stmt_ok_expr_lexpr . . . . . . . . . . . . . . . . . . 2960
C.204.41 ok_result_fstmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2960
C.204.42 pm_q_prop_read_ok_s_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . 2960
C.205 Proofs for Single_Statement_Rewrites2 (statement-rewrites.pvs). . . . . . . . . . . . . 2961
C.205.1 ok_result_fexpr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2961

485 C Proof scripts

C.205.2 e2s_merge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2961
C.205.3 stmt_e2s_merge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2961
C.205.4 e2s_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2962
C.205.5 stmt_e2s_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2962
C.205.6 composition_assoc_expression_rewrite_stmt . . . . . . . . . . . . . . . . . . . . 2962
C.205.7 comp_eval_if_ok_fstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2962
C.205.8 stmt_eval_if_ok_fstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2963
C.205.9 stmt_eval_if_ok_fexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2963
C.205.10 comp_eval_if_ok_fstmt_cstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2963
C.205.11 stmt_eval_if_ok_fstmt_cstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2964
C.206 Proofs for Single_Statement_Rewrites3 (statement-rewrites.pvs). . . . . . . . . . . . . 2964
C.206.1 ok_result_elemination_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2964
C.206.2 comp_eval_if_ok_fexpr_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2965
C.206.3 expr_eval_if_ok_fexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2965
C.206.4 composition_assoc_expression_rewrite . . . . . . . . . . . . . . . . . . . . . . . 2965
C.206.5 stmt_eval_if_ok_fexpr_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2966
C.207 Proofs for Single_Statement_Rewrites4 (statement-rewrites.pvs). . . . . . . . . . . . . 2966
C.207.1 expr_eval_if_ok_fexpr_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2966
C.208 Proofs for SkipStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . 2966
C.209 Proofs for State_Transformer (state-transformer.pvs) . . . . . . . . . . . . . . . . . . . 2966
C.210 Proofs for State_Transformer_Lift (state-transformer.pvs). . . . . . . . . . . . . . . . . 2967
C.211 Proofs for State_Transformer_Lift_Expr (state-transformer.pvs). . . . . . . . . . . . . 2967
C.211.1 ok_result_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.2 ok_result_data_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.3 ok_result_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.4 ok_result_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.5 expr_2_super_ok_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.6 ok_lift_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.7 has_next_state_ok_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.8 has_next_state_fatal_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.9 expr_2_super_fatal_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.212 Proofs for State_Transformer_Lift_Stmt (state-transformer.pvs). . . . . . . . . . . . . 2969
C.213 Proofs for Statement_Composition_Rewrites (state-transformer.pvs). . . . . . . . . . . 2969
C.213.1 composition_assoc_rewrite_1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2969
C.213.2 composition_assoc_rewrite_2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2969
C.213.3 composition_assoc_rewrite_3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2969
C.213.4 composition_assoc_rewrite_4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2970
C.213.5 composition_assoc_rewrite_5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2970
C.213.6 composition_assoc_rewrite_6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2970
C.213.7 composition_assoc_rewrite_7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2971
C.213.8 composition_assoc_rewrite_8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2971
C.214 Proofs for Statement_Rewrites (statement-rewrites.pvs). . . . . . . . . . . . . . . . . . 2971
C.215 Proofs for Statements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 2971
C.216 Proofs for StmtResult (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.217 Proofs for StmtResult_adt (StmtResult_adt.pvs). . . . . . . . . . . . . . . . . . . . . . 2972
C.218 Proofs for StmtResult_adt_map (StmtResult_adt.pvs) . . . . . . . . . . . . . . . . . . . 2972
C.219 Proofs for StmtResult_adt_reduce (StmtResult_adt.pvs) . . . . . . . . . . . . . . . . . . 2972
C.220 Proofs for Subtype_stable (graph.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.220.1 length_stable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.220.2 nth_stable_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.220.3 nth_stable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2973
C.221 Proofs for SuperResult (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2974

486

Contents for Appendix C

C.222 Proofs for SuperResult_adt (SuperResult_adt.pvs). . . . . . . . . . . . . . . . . . . . . 2974
C.223 Proofs for SuperResult_adt_map (SuperResult_adt.pvs) . . . . . . . . . . . . . . . . . . 2974
C.224 Proofs for SuperResult_adt_reduce (SuperResult_adt.pvs) . . . . . . . . . . . . . . . . . 2974
C.225 Proofs for Super_Embedding (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 2974
C.226 Proofs for Super_Embedding_Expr (result.pvs). . . . . . . . . . . . . . . . . . . . . . . 2974
C.226.1 expr_2_super_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2974
C.226.2 expr_2_super_res_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2974
C.227 Proofs for Super_Embedding_Stmt (result.pvs). . . . . . . . . . . . . . . . . . . . . . . 2975
C.227.1 stmt_2_super_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2975
C.227.2 stmt_2_super_res_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2975
C.228 Proofs for Super_Result_Util (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2975
C.229 Proofs for Transformer_Invariant (state-transformer.pvs) . . . . . . . . . . . . . . . . . 2976
C.229.1 result_pred_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2976
C.229.2 super_transformer_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . . . . . 2976
C.229.3 super_transformer_invariant_next_ok . . . . . . . . . . . . . . . . . . . . . . . 2976
C.229.4 transformer_invariant_mono_transformers. . . . . . . . . . . . . . . . . . . . 2977
C.229.5 transformer_invariant_union_transformers. . . . . . . . . . . . . . . . . . . . 2977
C.229.6 transformer_invariant_truth. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2978
C.229.7 transformer_invariant_all_transformers. . . . . . . . . . . . . . . . . . . . . . 2978
C.229.8 super_transformers_ok_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2978
C.229.9 transformers_ok_mono_transformers. . . . . . . . . . . . . . . . . . . . . . . 2979
C.229.10 transformers_ok_mono_states. . . . . . . . . . . . . . . . . . . . . . . . . . . 2979
C.229.11 transformers_ok_union_transformers. . . . . . . . . . . . . . . . . . . . . . . 2979
C.229.12 transformers_ok_all_transformers. . . . . . . . . . . . . . . . . . . . . . . . . 2980
C.230 Proofs for Transformer_Invariant_2 (state-transformer.pvs). . . . . . . . . . . . . . . . 2981
C.230.1 expr_transformer_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . . . . . . 2981
C.230.2 expr_transformer_invariant_next_ok . . . . . . . . . . . . . . . . . . . . . . . . 2981
C.230.3 expr_transformers_ok_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2981
C.230.4 expr_result_pred_next_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2982
C.230.5 expr_result_pred_next_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2982
C.231 Proofs for Transformer_Invariant_3 (state-transformer.pvs). . . . . . . . . . . . . . . . 2982
C.231.1 fexpr_composition_transformers_ok. . . . . . . . . . . . . . . . . . . . . . . . 2982
C.231.2 expr_composition_transformers_ok. . . . . . . . . . . . . . . . . . . . . . . . 2983
C.231.3 fexpr_composition_transformer_invariant . . . . . . . . . . . . . . . . . . . . . 2984
C.231.4 expr_composition_transformer_invariant. . . . . . . . . . . . . . . . . . . . . 2985
C.232 Proofs for Transformer_Super_Embedding (state-transformer.pvs). . . . . . . . . . . . 2985
C.233 Proofs for Transformer_Super_Embedding_Expr (state-transformer.pvs) . . . . . . . . . 2985
C.233.1 ok_expr_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2985
C.233.2 has_next_state_expr_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2986
C.233.3 state_expr_2_super_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2986
C.233.4 state_expr_2_super_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2986
C.233.5 state_expr_2_super. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234 Proofs for Transformer_Super_Embedding_Stmt (state-transformer.pvs) . . . . . . . . . 2987
C.234.1 ok_stmt_2_super. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234.2 has_next_state_stmt_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234.3 state_stmt_2_super_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234.4 state_stmt_2_super_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2988
C.234.5 state_stmt_2_super. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2988
C.235 Proofs for UnaryExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2988
C.235.1 deref_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2988
C.235.2 arrow_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2989
C.235.3 arrow_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2989

487 C Proof scripts

C.235.4 unary_minus_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2989
C.235.5 unary_minus_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.6 unary_minus_unsigned_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.7 unary_minus_unsigned_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.8 preinc_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.9 sizeof_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2991
C.236 Proofs for Uninterpreted_Data (abstract_data.pvs). . . . . . . . . . . . . . . . . . . . . 2991
C.236.1 u_data_type_length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2991
C.237 Proofs for Unit (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2991
C.238 Proofs for Unit_adt (Unit_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2992
C.239 Proofs for Unit_adt_reduce (Unit_adt.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 2992
C.240 Proofs for While_Hoare (statement-rewrites.pvs). . . . . . . . . . . . . . . . . . . . . . 2992
C.240.1 iterate_while_right. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2992
C.240.2 while_variant?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2993
C.240.3 while_no_cb_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2995
C.240.4 while_no_cb_cb_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2995
C.240.5 iterate_while_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2995
C.240.6 min_termination_point_no_less . . . . . . . . . . . . . . . . . . . . . . . . . . . 2997
C.240.7 while_terminates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2997
C.240.8 hoare_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2997
C.241 Proofs for While_Rewrites (statement-rewrites.pvs) . . . . . . . . . . . . . . . . . . . . 2998
C.241.1 while_to_while_no_cb . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2998
C.241.2 while_inv_rewrite_termination_result . . . . . . . . . . . . . . . . . . . . . . . 2998
C.241.3 while_inv_rewrite_data_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2998
C.241.4 while_inv_rewrite_data_break . . . . . . . . . . . . . . . . . . . . . . . . . . . 2999
C.241.5 while_inv_rewrite_data_return . . . . . . . . . . . . . . . . . . . . . . . . . . . 2999
C.241.6 stmt_while_inv_rewrite_termination_result_TCC1 . . . . . . . . . . . . . . . . 3000
C.241.7 stmt_while_inv_rewrite_termination_result . . . . . . . . . . . . . . . . . . . . 3000
C.241.8 stmt_while_inv_rewrite_data_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 3001
C.241.9 stmt_while_inv_rewrite_data_break . . . . . . . . . . . . . . . . . . . . . . . . 3002
C.241.10 stmt_while_inv_rewrite_data_return . . . . . . . . . . . . . . . . . . . . . . . . 3002
C.241.11 pm_q_prop_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3003
C.241.12 pm_q_prop_stmt_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 3004
C.241.13 pm_q_prop_stmt_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3004

488

C.1 Proofs for Abstract_Read_Write (abstract_data.pvs)

C.1 Proofs for Abstract_Read_Write (abstract_data.pvs)

C.1.1 Abstract_Read_Write.read_data_valid_in_mem

                                                                                                                        Terse proof for read_data_valid_in_mem.
                                                                                                                        read_data_valid_in_mem:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Memory_struct[State], s: State): OK?(read_data(pm, dt)(addr)(s)) ⊃ valid_in_mem(pm, dt)(addr)(s)

Repeatedly Skolemizing and flattening, Expanding the definition of valid_in_mem, Expanding the definition of read_data, Expanding the definition of ok_lift, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using valid_iff_from_byte, matching in * where idt gets dt!1, This completes the proof of read_data_valid_in_mem. Q.E.D.

C.2 Proofs for Abstract_Read_Write_Plain

(plain_memory.pvs)

This theory contains no provable formal statements.

C.3 Proofs for Address_Datatype (paging-data.pvs)

C.3.1 Address_Datatype.address_data_type_TCC1

                                                                                                                        Terse proof for address_data_type_TCC1.
                                                                                                                        address_data_type_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[Memory_Address_4G])): true

Using lemma address_data_type_exists,

This completes the proof of address_data_type_TCC1.

Q.E.D.

C.4 Proofs for Address_Helpers (constants.pvs)

C.4.1 Address_Helpers.type_add_rewrite

                                                                                                                        Terse proof for type_add_rewrite.
                                                                                                                        type_add_rewrite:

{1} ∀ (m_addr: Memory_Address, size: int): (m_addr+ size)`type_of = m_addr`type_of

Trying repeated skolemization, instantiation, and if-lifting,

489 C Proof scripts

This completes the proof of type_add_rewrite.

Q.E.D.

C.4.2 Address_Helpers.offset_add_rewrite

                                                                                                                        Terse proof for offset_add_rewrite.
                                                                                                                        offset_add_rewrite:

{1} ∀ (m_addr: Memory_Address, size: int):

(m_addr+ size)`offset = m_addr‘offset + size

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of offset_add_rewrite.

Q.E.D.

C.4.3 Address_Helpers.type_add_memory

                                                                                                                        Terse proof for type_add_memory.
                                                                                                                        type_add_memory:

{1} ∀ (m_addr, size): Mem?((m_addr+ size)`type_of)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of type_add_memory.

Q.E.D.

C.4.4 Address_Helpers.address_add_zero

                                                                                                                        Terse proof for address_add_zero.
                                                                                                                        address_add_zero:

{1} ∀ (a: Address): a + 0 = a

Expanding the definition of +,

which is trivially true.

This completes the proof of address_add_zero.

Q.E.D.

C.4.5 Address_Helpers.address_add_sum

                                                                                                                        Terse proof for address_add_sum.
                                                                                                                        address_add_sum:

{1} ∀ (a: Address, i, j: int): (a + i) + j = a + (i + j)

Expanding the definition of +,

which is trivially true.

This completes the proof of address_add_sum.

Q.E.D.

490

C.5 Proofs for Address_Model (paging-data-models.pvs)

C.4.6 Address_Helpers.reg_size_TCC1

Terse proof for reg_size_TCC1.

                                                                                                                        reg_size_TCC1:

{1} ∀ (max: Memory_Address, id: Register_Id): ¬ SYSENTER_EIP?(id) ∧ ¬ SYSENTER_ESP?(id) ∧ ¬ SYSENTER_CS?(id) ∧ ¬ TR?(id) ∧ ¬ LDTR?(id) ∧ ¬ GDTR?(id) ∧ ¬ IDTR?(id) ∧ ¬ EFLAGS?(id) ∧ ¬ IP?(id) ∧ ¬ Mem?(id) ⊃ ¬ (GP?(id) ∧ Segment_Reg?(id)) ∧ ¬ (Segment_Reg?(id) ∧ Control_Reg?(id))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of reg_size_TCC1.

Q.E.D.

C.4.7 Address_Helpers.reg_size_TCC2

Terse proof for reg_size_TCC2.

                                                                                                                        reg_size_TCC2:

{1} ∀ (max: Memory_Address, id: Register_Id): ¬ SYSENTER_EIP?(id) ∧ ¬ SYSENTER_ESP?(id) ∧ ¬ SYSENTER_CS?(id) ∧ ¬ TR?(id) ∧ ¬ LDTR?(id) ∧ ¬ GDTR?(id) ∧ ¬ IDTR?(id) ∧ ¬ EFLAGS?(id) ∧ ¬ IP?(id) ∧ ¬ Mem?(id) ⊃ GP?(id) ∨ Segment_Reg?(id) ∨ Control_Reg?(id)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of reg_size_TCC2.

Q.E.D.

C.5 Proofs for Address_Model (paging-data-models.pvs)

C.5.1 Address_Model.address_to_byte_TCC1

                                                                                                                        Terse proof for address_to_byte_TCC1.
                                                                                                                        address_to_byte_TCC1:

{1} ∀ (addr: Memory_Address_4G): offset(addr) ≥ 0

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less overwrite_shift_bits_less max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of address_to_byte_TCC1.

Q.E.D.

491 C Proof scripts

C.5.2 Address_Model.address_to_byte_TCC2

                                                                                                                        Terse proof for address_to_byte_TCC2.
                                                                                                                        address_to_byte_TCC2:

{1} ∀ (addr: Memory_Address_4G): cut_bits(offset(addr), 0, 8) < max_byte

Repeatedly Skolemizing and flattening,

Using lemma cut_bits_below,

Rewriting using less_than_max_byte, matching in *, This completes the proof of address_to_byte_TCC2. Q.E.D.

C.5.3 Address_Model.address_to_byte_TCC3

                                                                                                                        Terse proof for address_to_byte_TCC3.
                                                                                                                        address_to_byte_TCC3:

{1} ∀ (addr: Memory_Address_4G):

every[nat] ({s: nat | s < max_byte}) ((:cut_bits(offset(addr), 8, 8), cut_bits(offset(addr), 16, 8),

cut_bits(offset(addr), 24, 8):))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less overwrite_shift_bits_less max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of address_to_byte_TCC3.

Q.E.D.

C.5.4 Address_Model.address_from_byte_TCC1

                                                                                                                        Terse proof for address_from_byte_TCC1.
                                                                                                                        address_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_from_byte_TCC1. Q.E.D.

C.5.5 Address_Model.address_from_byte_TCC2

                                                                                                                        Terse proof for address_from_byte_TCC2.
                                                                                                                        address_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_from_byte_TCC2. Q.E.D.

492

C.5 Proofs for Address_Model (paging-data-models.pvs)

C.5.6 Address_Model.address_from_byte_TCC3

                                                                                                                        Terse proof for address_from_byte_TCC3.
                                                                                                                        address_from_byte_TCC3:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_from_byte_TCC3.

Q.E.D.

C.5.7 Address_Model.address_from_byte_TCC4

                                                                                                                        Terse proof for address_from_byte_TCC4.
                                                                                                                        address_from_byte_TCC4:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 3 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_from_byte_TCC4.

Q.E.D.

C.5.8 Address_Model.address_from_byte_TCC5

                                                                                                                        Terse proof for address_from_byte_TCC5.

493 C Proof scripts

                                                                                                                        address_from_byte_TCC5:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ Mem?(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte] (data, 0),

                                                                                                                        0,

8), nth[Byte] (data, 1),

                                                                                                                        8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`type_of)

∧ 0 ≤ Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte] (data, 0),

                                                                                                                        0,

8), nth[Byte] (data, 1),

                                                                                                                        8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

∧

Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte] (data, 0),

                                                                                                                        0,

8), nth[Byte] (data, 1),

                                                                                                                        8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

< max_linear_offset

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: every aligned_address? aligned_overwrite_shift_bits_more aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less address_valid? max_linear_offset bus_width Expanding the definition of Mem, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_from_byte_TCC5.

494

C.5 Proofs for Address_Model (paging-data-models.pvs)

Q.E.D.

C.5.9 Address_Model.address_model_TCC1

                                                                                                                        Terse proof for address_model_TCC1.
                                                                                                                        address_model_TCC1:

{1} ∀ (f: [[Memory_Address_4G, Address] → [list[Byte] → bool]]): (f = (λ (d: Memory_Address_4G, a: Address): (zero_mask?(4)))) ⊃ (∀ (x_{1}: [Memory_Address_4G, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening,

Replacing using formula -1,

Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of address_model_TCC1. Q.E.D.

C.5.10 Address_Model.address_valid_to_byte

                                                                                                                        Terse proof for address_valid_to_byte.
                                                                                                                        address_valid_to_byte:

{1} ∀ (d: Memory_Address_4G, a: Address):

valid?(uidt(address_model))(to_byte(address_model)(d, a), a)

Installing automatic rewrites from: address_model address_to_byte length address_valid?

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement, This completes the proof of address_valid_to_byte. Q.E.D.

C.5.11 Address_Model.address_is_pod

                                                                                                                        Terse proof for address_is_pod.
                                                                                                                        address_is_pod:

{1} pod_data_type?(address_model)

Expanding the definition of pod_data_type?,

Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying propositional simplification, we get 6 subgoals:

                                                                                                                        address_is_pod.1:

{1} ∀ (l: list[Byte], a: Address):

¬ length(l) = size(address_model`uidt) ⊃ ¬ valid?(address_model`uidt)(l, a)

Repeatedly Skolemizing and flattening, Expanding the definition of address_model,

495 C Proof scripts

Expanding the definition of address_valid?,

which is trivially true.

This completes the proof of address_is_pod.1.

                                                                                                                        address_is_pod.2:

{1} ∀ (d: Memory_Address_4G, a: Address): valid?(uidt(address_model))(to_byte(address_model)(d, a), a)

Repeatedly Skolemizing and flattening,

Rewriting using address_valid_to_byte, matching in *,

This completes the proof of address_is_pod.2.

                                                                                                                        address_is_pod.3:

{1} ∀ (l: list[Byte], a: Address):

valid?(uidt(address_model))(l, a) ≡ up?(from_byte(address_model)(l, a))

Repeatedly Skolemizing and flattening, Expanding the definition of address_model, Expanding the definition of address_from_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_is_pod.3.

                                                                                                                        address_is_pod.4:

{1} ∀ (d: Memory_Address_4G, a: Address): down(from_byte(address_model)(to_byte(address_model)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_model address_from_byte address_to_byte address_valid? length nth overwrite_shift_bits_zero cut_bits_cut_bits overwrite_shift_bits_merge max_linear_offset bus_width zero_aligned

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using shift_bits_left_cut_bits, matching in *,

Applying extensionality,

we get 2 subgoals:

                                                                                                                        address_is_pod.4.1:

{-1} Mem?(d′`type_of)
{-2} 0 ≤ d′`offset
{-3} d′`offset < expt(2, 32)
{1} Mem(offset(d′))`offset = d′`offset

Expanding the definition of Mem,

which is trivially true.

This completes the proof of address_is_pod.4.1.

                                                                                                                        address_is_pod.4.2:

{-1} Mem?(d′`type_of)
{-2} 0 ≤ d′`offset
{-3} d′`offset < expt(2, 32)
{1} Mem(offset(d′))`type_of = d′`type_of

Expanding the definition of Mem,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of address_is_pod.4.2.

496

C.6 Proofs for Address_Util (memory.pvs)

                                                                                                                        address_is_pod.5:

{1} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(address_model))(l, a_{1}) ≡ valid?(uidt(address_model))(l, a_{2})

Repeatedly Skolemizing and flattening,

Hiding formulas: -1,

Expanding the definition of address_model, Expanding the definition of address_valid?, which is trivially true. This completes the proof of address_is_pod.5.

                                                                                                                        address_is_pod.6:

{1} size(uidt(address_model)) > 0

Expanding the definition of address_model,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_is_pod.6. Q.E.D.

C.6 Proofs for Address_Util (memory.pvs)

C.6.1 Address_Util.address_block_subset_1

                                                                                                                        Terse proof for address_block_subset_1.
                                                                                                                        address_block_subset_1:

{1} ∀ (addr: Address, size: nat):

(address_block(addr + 1, size) ⊆ address_block(addr, 1 + size))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_block_subset_1. Q.E.D.

C.6.2 Address_Util.address_block_subset_2

                                                                                                                        Terse proof for address_block_subset_2.
                                                                                                                        address_block_subset_2:

{1} ∀ (addresses: PRED[Address], addr: Address, size: nat): (address_block(addr, size + 1) ⊆ addresses) ⊃ (address_block(addr + 1, size) ⊆ addresses)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_block_subset_2. Q.E.D.

C.6.3 Address_Util.blocks_disjoint_disjoint

                                                                                                                        Terse proof for blocks_disjoint_disjoint.

497 C Proof scripts

                                                                                                                        blocks_disjoint_disjoint:

{1} ∀ (addr1, addr2: Address, size1, size2: nat):

size1 > 0 ∧ size2 > 0 ⊃ blocks_disjoint?(addr1, size1, addr2, size2) = disjoint?(address_block(addr1, size1), address_block(addr2, size2))

Repeatedly Skolemizing and flattening,

Converting equality to IFF,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        blocks_disjoint_disjoint.1:

{-1} size1′ ≥ 0
{-2} size2′ ≥ 0
{-3} size1′ > 0
{-4} size2′ > 0
{-5} blocks_disjoint?(addr1′, size1′, addr2′, size2′)
{1} disjoint?(address_block(addr1′, size1′), address_block(addr2′, size2′))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of blocks_disjoint_disjoint.1.
                                                                                                                        blocks_disjoint_disjoint.2:

{-1} size1′ ≥ 0
{-2} size2′ ≥ 0
{-3} size1′ > 0
{-4} size2′ > 0
{-5} disjoint?(address_block(addr1′, size1′), address_block(addr2′, size2′))
{1} blocks_disjoint?(addr1′, size1′, addr2′, size2′)

Expanding the definition of blocks_disjoint?,

Applying disjunctive simplification to flatten sequent,

Expanding the definition(s) of (disjoint? empty? intersection member),

Case splitting on addr1!1 < addr2!1,

we get 2 subgoals:

                                                                                                                        blocks_disjoint_disjoint.2.1:

{-1} addr1′ < addr2′
{-2} size1′ ≥ 0
{-3} size2′ ≥ 0
{-4} size1′ > 0
{-5} size2′ > 0
{-6} type_of(addr1′) = type_of(addr2′)
{-7} ∀ (x: Address):

¬ (address_block(addr1′, size1′)(x) ∧ address_block(addr2′, size2′)(x))

{1} addr1′ + size1′ ≤ addr2′
{2} addr2′ + size2′ ≤ addr1′

Instantiating the top quantifier in -7 with the terms: addr2′, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of blocks_disjoint_disjoint.2.1.

498

C.6 Proofs for Address_Util (memory.pvs)

                                                                                                                        blocks_disjoint_disjoint.2.2:

{-1} size1′ ≥ 0
{-2} size2′ ≥ 0
{-3} size1′ > 0
{-4} size2′ > 0
{-5} type_of(addr1′) = type_of(addr2′)
{-6} ∀ (x: Address):

¬ (address_block(addr1′, size1′)(x) ∧ address_block(addr2′, size2′)(x))

{1} addr1′ < addr2′
{2} addr1′ + size1′ ≤ addr2′
{3} addr2′ + size2′ ≤ addr1′

Instantiating the top quantifier in -6 with the terms: addr1′, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of blocks_disjoint_disjoint.2.2.

Q.E.D.

C.6.4 Address_Util.blocks_disjoint_symmetric

                                                                                                                        Terse proof for blocks_disjoint_symmetric.
                                                                                                                        blocks_disjoint_symmetric:

{1} ∀ (addr1, addr2: Address, size1, size2: nat):

blocks_disjoint?(addr1, size1, addr2, size2) = blocks_disjoint?(addr2, size2, addr1, size1)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of blocks_disjoint_symmetric.

Q.E.D.

C.6.5 Address_Util.blocks_in_larger_set

                                                                                                                        Terse proof for blocks_in_larger_set.
                                                                                                                        blocks_in_larger_set:

{1} ∀ (addr1, addr2: Address, size1, size2: nat, addresses: PRED[Address]): (address_block(addr1, size1) ⊆ addresses) ∧ (address_block(addr2, size2) ⊆ addresses) ∧ blocks_disjoint?(addr1, size1, addr2, size2) ⊃ (address_block(addr2, size2) ⊆ (addresses \ address_block(addr1, size1)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of blocks_in_larger_set. Q.E.D.

C.6.6 Address_Util.blocks_pairwise_disjoint_add

                                                                                                                        Terse proof for blocks_pairwise_disjoint_add.

499 C Proof scripts

                                                                                                                        blocks_pairwise_disjoint_add:

{1} ∀ (addr: Address, size: posnat, blocks: list[[Address, posnat]]): blocks_pairwise_disjoint(blocks) ∧ (∀ (oaddr: Address, osize: posnat): member((oaddr, osize), blocks) ⊃ blocks_disjoint?(addr, size, oaddr, osize)) ⊃ blocks_pairwise_disjoint(cons((addr, size), blocks))

Expanding the definition of blocks_pairwise_disjoint,

Repeatedly Skolemizing and flattening, Expanding the definition of member, Case splitting on addr!2 = addr!1 AND size!2 = size!1, we get 2 subgoals:

                                                                                                                        blocks_pairwise_disjoint_add.1:

{-1} addr′′ = addr′ ∧ size′′ = size′
{-2} size′′ > 0
{-3} size′′′ > 0
{-4} size′ > 0

{-5} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-6} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-7} addr′′ = addr′ ∧ size′′ = size′ ∨ member((addr′′, size′′), blocks′)
{-8} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of list_remove,

Rewriting using member_list_remove, matching in *,

Instantiating the top quantifier in -7 with the terms: addr′′′, size′′′, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of blocks_pairwise_disjoint_add.1.
                                                                                                                        blocks_pairwise_disjoint_add.2:

{-1} size′′ > 0
{-2} size′′′ > 0
{-3} size′ > 0

{-4} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-5} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-6} addr′′ = addr′ ∧ size′′ = size′ ∨ member((addr′′, size′′), blocks′)
{-7} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Splitting conjunctions, we get 2 subgoals:

500

C.6 Proofs for Address_Util (memory.pvs)

blocks_pairwise_disjoint_add.2.1:

{-1} addr′′ = addr′ ∧ size′′ = size′
{-2} size′′ > 0
{-3} size′′′ > 0
{-4} size′ > 0

{-5} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-6} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-7} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

which is trivially true.

This completes the proof of blocks_pairwise_disjoint_add.2.1.
blocks_pairwise_disjoint_add.2.2:

{-1} member((addr′′, size′′), blocks′)
{-2} size′′ > 0
{-3} size′′′ > 0
{-4} size′ > 0

{-5} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-6} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-7} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Expanding the definition of list_remove, Lifting IF-conditions to the top level, Splitting conjunctions, we get 2 subgoals:

blocks_pairwise_disjoint_add.2.2.1:

{-1} (addr′′ = addr′ ∧ size′′ = size′) ∧

member((addr′′′, size′′′), list_remove((addr′′, size′′), blocks′))

{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

501 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                             This completes the proof of blocks_pairwise_disjoint_add.2.2.1.
                                                                                                             blocks_pairwise_disjoint_add.2.2.2:

{-1} ¬ (addr′′ = addr′ ∧ size′′ = size′) ∧

member((addr′′′, size′′′),

cons((addr′, size′), list_remove((addr′′, size′′), blocks′)))

{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Applying disjunctive simplification to flatten sequent,

Hiding formulas: 1,

Expanding the definition of member,

Splitting conjunctions,

we get 2 subgoals:

                                                                                                             blocks_pairwise_disjoint_add.2.2.2.1:

{-1} addr′′′ = addr′ ∧ size′′′ = size′
{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat):

member((addr_1, size_1), blocks′) ∧

member((addr_2, size_2), list_remove((addr_1, size_1), blocks′))

⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Applying disjunctive simplification to flatten sequent,

Instantiating the top quantifier in -8 with the terms: addr′′, size′′,

Simplifying, rewriting, and recording with decision procedures,

Rewriting using blocks_disjoint_symmetric, matching in *,

                                                                                                             This completes the proof of blocks_pairwise_disjoint_add.2.2.2.1.

502

C.6 Proofs for Address_Util (memory.pvs)

                                                                                                                        blocks_pairwise_disjoint_add.2.2.2.2:

{-1} member((addr′′′, size′′′), list_remove((addr′′, size′′), blocks′))
{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Instantiating the top quantifier in -6 with the terms: addr′′, addr′′′, size′′, size′′′, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of blocks_pairwise_disjoint_add.2.2.2.2.

Q.E.D.

C.6.7 Address_Util.blocks_pairwise_disjoint_remove

                                                                                                                        Terse proof for blocks_pairwise_disjoint_remove.
                                                                                                                        blocks_pairwise_disjoint_remove:

{1} ∀ (addr: Address, size: posnat, blocks: list[[Address, posnat]]): blocks_pairwise_disjoint(blocks) ⊃ blocks_pairwise_disjoint(list_remove((addr, size), blocks))

Expanding the definition of blocks_pairwise_disjoint,

Repeatedly Skolemizing and flattening,

Rewriting using list_remove_commutative, matching in *, Rewriting using member_list_remove, matching in *, Rewriting using member_list_remove, matching in *, Instantiating the top quantifier in -4 with the terms: addr′′, addr′′′, size′′, size′′′, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of blocks_pairwise_disjoint_remove.

Q.E.D.

C.6.8 Address_Util.subset_block_is_free

                                                                                                                        Terse proof for subset_block_is_free.
                                                                                                                        subset_block_is_free:

{1} ∀ (b_{1}, b_{2}: PRED[Address], alloc_points: list[[Address, posnat]]): (b_{1} ⊆ b_{2}) ∧ block_is_free(b_{2}, alloc_points) ⊃ block_is_free(b_{1}, alloc_points)

Repeatedly Skolemizing and flattening, Expanding the definition of block_is_free, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

503 C Proof scripts

Using lemma disjoint_mono,

Simplifying, rewriting, and recording with decision procedures,

Rewriting using subset_equal, matching in *,

This completes the proof of subset_block_is_free.

Q.E.D.

C.6.9 Address_Util.block_is_free_add

                                                                                                                        Terse proof for block_is_free_add.
                                                                                                                        block_is_free_add:

{1} ∀ (block: PRED[Address], alloc_points: list[[Address, posnat]], addr: Address, size: posnat): block_is_free(block, alloc_points) ∧ disjoint?(block, address_block(addr, size)) ⊃ block_is_free(block, cons((addr, size), alloc_points))

Repeatedly Skolemizing and flattening, Expanding the definition of block_is_free, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: member Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: addr′′, size′′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of block_is_free_add. Q.E.D.

C.7 Proofs for Alignment (vfiasco-prelude.pvs)

C.7.1 Alignment.aligned_zero

Terse proof for aligned_zero.

                                                                                                                        aligned_zero:

{1} ∀ (n: nat): aligned?(n)(0)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Rewriting using divides_zero, matching in *, This completes the proof of aligned_zero. Q.E.D.

C.7.2 Alignment.zero_aligned

Terse proof for zero_aligned.

                                                                                                                        zero_aligned:

{1} ∀ (n: nat): aligned?(0)(n)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Expanding the definition of expt,

504

C.7 Proofs for Alignment (vfiasco-prelude.pvs)

Rewriting using one_divides, matching in *, This completes the proof of zero_aligned. Q.E.D.

C.7.3 Alignment.aligned_bigger

                                                                                                                        Terse proof for aligned_bigger.
                                                                                                                        aligned_bigger:

{1} ∀ (m, n_{1}, n_{2}: nat): n_{2} ≤ n_{1} ∧ aligned?(n_{1})(m) ⊃ aligned?(n_{2})(m)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Forward chaining on divides_expt_gt, This completes the proof of aligned_bigger. Q.E.D.

C.7.4 Alignment.aligned_plus

Terse proof for aligned_plus.

                                                                                                                        aligned_plus:

{1} ∀ (m, n: nat, a: aligned(n), b: aligned(m)):

aligned?(min(n, m))(a + b)

Repeatedly Skolemizing and flattening,

Expanding the definition of min, Expanding the definition of aligned?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

                                                                                                                        aligned_plus.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{-5} n′ > m′
{1} divides(expt(2, m′), a′ + b′)

Rewriting using divides_sum, matching in *,

Hiding formulas: -4, 2, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_plus.1.

505 C Proof scripts

                                                                                                                        aligned_plus.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{1} n′ > m′
{2} divides(expt(2, n′), a′ + b′)

Rewriting using divides_sum, matching in *,

Hiding formulas: -3, 3, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_plus.2. Q.E.D.

C.7.5 Alignment.aligned_plus_n

                                                                                                                        Terse proof for aligned_plus_n.
                                                                                                                        aligned_plus_n:

{1} ∀ (n: nat, a, b: aligned(n)): aligned?(n)(a + b)

Repeatedly Skolemizing and flattening,

Using lemma aligned_plus, Expanding the definition of min, which is trivially true. This completes the proof of aligned_plus_n. Q.E.D.

C.7.6 Alignment.aligned_minus_TCC1

                                                                                                                        Terse proof for aligned_minus_TCC1.
                                                                                                                        aligned_minus_TCC1:

{1} ∀ (m, n: nat, a: aligned(n), b: aligned(m)): a ≥ b ⊃ a − b ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of aligned_minus_TCC1.

Q.E.D.

C.7.7 Alignment.aligned_minus

Terse proof for aligned_minus.

                                                                                                                        aligned_minus:

{1} ∀ (m, n: nat, a: aligned(n), b: aligned(m)):
a ≥ b ⊃ aligned?(min(n, m))(a − b)

Repeatedly Skolemizing and flattening,

506

C.7 Proofs for Alignment (vfiasco-prelude.pvs)

Expanding the definition of min, Expanding the definition of aligned?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

                                                                                                                        aligned_minus.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{-5} a′ ≥ b′
{-6} n′ > m′
{1} divides(expt(2, m′), a′ − b′)

Rewriting using divides_diff, matching in *,

Hiding formulas: -4, 2, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_minus.1.

                                                                                                                        aligned_minus.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{-5} a′ ≥ b′
{1} n′ > m′
{2} divides(expt(2, n′), a′ − b′)

Rewriting using divides_diff, matching in *,

Hiding formulas: -3, 3, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_minus.2. Q.E.D.

C.7.8 Alignment.aligned_mult_expt_2

                                                                                                                        Terse proof for aligned_mult_expt_2.
                                                                                                                        aligned_mult_expt_2:

{1} ∀ (m, n: nat, a: aligned(n)): aligned?(n + m)(a × expt(2, m))

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Rewriting using expt_plus_aux, matching in *, Using lemma divides_prod_elim1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_mult_expt_2. Q.E.D.

507 C Proof scripts

C.7.9 Alignment.aligned_rem

Terse proof for aligned_rem.

                                                                                                                        aligned_rem:

{1} ∀ (m, n, i: nat): aligned?(n)(m) ⊃ aligned?(n)(rem(expt(2, i))(m))

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, n′), rem(expt(2, i′))(m′), 0, we get 2 subgoals:

                                                                                                                        aligned_rem.1:

{-1} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0 ≡

divides(expt(2, n′), rem(expt(2, i′))(m′) − 0)

{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} divides(expt(2, n′), rem(expt(2, i′))(m′))

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: 2,

Case splitting on i!1 <= n!1,

we get 2 subgoals:

                                                                                                                        aligned_rem.1.1:

{-1} i′ ≤ n′
{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Rewriting using rem_mod, matching in *,

we get 2 subgoals:

                                                                                                                        aligned_rem.1.1.1:

{-1} i′ ≤ n′
{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} rem(expt(2, i′))(m′) = 0

Using lemma rem_def2,

Simplifying, rewriting, and recording with decision procedures,

Forward chaining on divides_expt_gt,

This completes the proof of aligned_rem.1.1.1.

508

C.7 Proofs for Alignment (vfiasco-prelude.pvs)

                                                                                                                        aligned_rem.1.1.2:

{-1} i′ ≤ n′
{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} rem(expt(2, i′))(m′) < expt(2, n′)
{2} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Using lemma both_sides_expt_gt1_le,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_rem.1.1.2.

                                                                                                                        aligned_rem.1.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} i′ ≤ n′
{2} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Rewriting using rem_rem, matching in *,

we get 2 subgoals:

                                                                                                                        aligned_rem.1.2.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} i′ ≤ n′
{2} rem(expt(2, n′))(m′) = 0

Rewriting using rem_def2, matching in *,

This completes the proof of aligned_rem.1.2.1.

                                                                                                                        aligned_rem.1.2.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} divides(expt(2, n′), expt(2, i′))
{2} i′ ≤ n′
{3} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Rewriting using expt_divides, matching in *, This completes the proof of aligned_rem.1.2.2.

                                                                                                                        aligned_rem.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} 0 < expt(2, n′)
{2} divides(expt(2, n′), rem(expt(2, i′))(m′))

Simplifying, rewriting, and recording with decision procedures,

509 C Proof scripts

This completes the proof of aligned_rem.2.

Q.E.D.

C.7.10 Alignment.aligned_add_below

                                                                                                                        Terse proof for aligned_add_below.
                                                                                                                        aligned_add_below:

{1} ∀ (n, m, i, k: nat):

i ≤ k ∧ n < expt(2, k) ∧ aligned?(i)(n) ∧ m < expt(2, i) ⊃

n + m < expt(2, k)

Repeatedly Skolemizing and flattening,

Expanding the definition of aligned?,

Expanding the definition of divides,

Repeatedly Skolemizing and flattening,

Replacing using formula -8,

Applying bit_split_less

Instantiating the top quantifier in -1 with the terms: x′, m′, k′ − i′, i′,

we get 3 subgoals:

                                                                                                                        aligned_add_below.1:

{-1} m′ < expt(2, i′) ⊃
(x′ × expt(2, i′) + m′ < expt(2, i′ + k′ − i′) ≡
x′ < expt(2, k′ − i′))
{-2} integer_pred(x′)
{-3} expt(2, i′) × x′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ ≥ 0
{-7} i′ ≤ k′
{-8} expt(2, i′) × x′ < expt(2, k′)
{-9} n′ = expt(2, i′) × x′
{-10} m′ < expt(2, i′)
{1} expt(2, i′) × x′ + m′ < expt(2, k′)

Simplifying, rewriting, and recording with decision procedures,

Applying both_sides_times_pos_lt2

Instantiating the top quantifier in -1 with the terms: expt(2, i′), x′, expt(2, k′ − i′),

Simplifying, rewriting, and recording with decision procedures,

Rewriting using expt_plus, matching in *,

This completes the proof of aligned_add_below.1.

510

C.8 Proofs for Allocation_Info (allocators.pvs)

                                                                                                                        aligned_add_below.2:

{-1} integer_pred(x′)
{-2} expt(2, i′) × x′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ ≥ 0
{-6} i′ ≤ k′
{-7} expt(2, i′) × x′ < expt(2, k′)
{-8} n′ = expt(2, i′) × x′
{-9} m′ < expt(2, i′)
{1} k′ − i′ ≥ 0
{2} expt(2, i′) × x′ + m′ < expt(2, k′)

Applying both_sides_expt_gt1_le

Instantiating the top quantifier in -1 with the terms: 2, i′, k′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_add_below.2.

                                                                                                                        aligned_add_below.3:

{-1} integer_pred(x′)
{-2} expt(2, i′) × x′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ ≥ 0
{-6} i′ ≤ k′
{-7} expt(2, i′) × x′ < expt(2, k′)
{-8} n′ = expt(2, i′) × x′
{-9} m′ < expt(2, i′)
{1} x′ ≥ 0
{2} expt(2, i′) × x′ + m′ < expt(2, k′)

Applying pos_times_le

Instantiating the top quantifier in -1 with the terms: expt(2, i′), x′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_add_below.3. Q.E.D.

C.8 Proofs for Allocation_Info (allocators.pvs)

C.8.1 Allocation_Info.consistent_allocator_state_change

                                                                                                                        Terse proof for consistent_allocator_state_change.
                                                                                                                        consistent_allocator_state_change:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), ac: (allocator?(pm)), s_{1}, s_{2}: State): consistent_allocator?(pm)(ac, ai)(s_{1}) ∧ ac`allocated(pm)(s_{1}) = ac`allocated(pm)(s_{2}) ⊃ consistent_allocator?(pm)(ac, ai)(s_{2})

Repeatedly Skolemizing and flattening,

Expanding the definition of consistent_allocator?, Applying disjunctive simplification to flatten sequent,

511 C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of consistent_allocator_state_change.

Q.E.D.

C.8.2 Allocation_Info.consistent_allocator_read_TCC1

                                                                                                                        Terse proof for consistent_allocator_read_TCC1.
                                                                                                                        consistent_allocator_read_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s)) ∨ Exception?[State, Byte](memory_read(pm`mem)(addr)(s))

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_memory_read_ok, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_read_TCC1.

Q.E.D.

C.8.3 Allocation_Info.consistent_allocator_read

                                                                                                                        Terse proof for consistent_allocator_read.
                                                                                                                        consistent_allocator_read:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)),

addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ consistent_allocator?(pm)(ac, ai)(state(memory_read(pm`mem)(addr)(s)))

Repeatedly Skolemizing and flattening,

Expanding the definition of consistent_allocator?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_allocated_memory_read, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_read.

Q.E.D.

C.8.4 Allocation_Info.consistent_allocator_write_TCC1

                                                                                                                        Terse proof for consistent_allocator_write_TCC1.

512

C.8 Proofs for Allocation_Info (allocators.pvs)

                                                                                                                        consistent_allocator_write_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address, byte: Byte): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ OK?[State, Unit](memory_write(pm`mem)(addr, byte)(s)) ∨ Exception?[State, Unit](memory_write(pm`mem)(addr, byte)(s))

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_memory_write_ok, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_write_TCC1.

Q.E.D.

C.8.5 Allocation_Info.consistent_allocator_write

                                                                                                                        Terse proof for consistent_allocator_write.
                                                                                                                        consistent_allocator_write:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)), addr: Ad-

dress,

byte: Byte): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ consistent_allocator?(pm)(ac, ai)(state(memory_write(pm`mem)(addr, byte)(s)))

Repeatedly Skolemizing and flattening,

Expanding the definition of consistent_allocator?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_allocated_memory_write, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_write.

Q.E.D.

C.8.6 Allocation_Info.consistent_allocator_alloc_TCC1

                                                                                                                        Terse proof for consistent_allocator_alloc_TCC1.
                                                                                                                        consistent_allocator_alloc_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), size: posnat): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

513 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of consistent_allocator_alloc_TCC1.

Q.E.D.

C.8.7 Allocation_Info.consistent_allocator_alloc

                                                                                                                        Terse proof for consistent_allocator_alloc.
                                                                                                                        consistent_allocator_alloc:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)),

size: posnat): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ consistent_allocator?(pm)(ac, cons((data(ac`alloc(pm)(size)(s)), size), ai)) (state(ac`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening,

Expanding the definition of consistent_allocator?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        consistent_allocator_alloc.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} size′ > 0
{-4} pm′`states(s′)
{-5} allocator_info?(ai′)

{-6} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-7} OK?(ac′`alloc(pm′)(size′)(s′))
{1} allocator_info?(cons((data(ac′`alloc(pm′)(size′)(s′)), size′), ai′))
{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Expanding the definition of allocator_info?,

Rewriting using blocks_pairwise_disjoint_add, matching in *,

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Rewriting using blocks_disjoint_disjoint, matching in *,

Instantiating the top quantifier in -8 with the terms: oaddr′, osize′, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Installing automatic rewrites from: subset_equal Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma allocator_alloc_disjoint, Simplifying, rewriting, and recording with decision procedures, Rewriting using disjoint_symmetric, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_alloc.1.

514

C.8 Proofs for Allocation_Info (allocators.pvs)

                                                                                                                        consistent_allocator_alloc.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} size′ > 0
{-4} pm′`states(s′)
{-5} allocator_info?(ai′)

{-6} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃

(address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (addr: Address, size: posnat):

member((addr, size), cons((data(ac′`alloc(pm′)(size′)(s′)), size′), ai′))

⊃

(address_block(addr, size) ⊆ ac′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′))))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Hiding formulas: -5,

Repeatedly Skolemizing and flattening,

Expanding the definition of member,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        consistent_allocator_alloc.2.1:

{-1} addr′ = data(ac′`alloc(pm′)(size′)(s′))
{-2} size′′ = size′
{-3} size′′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} size′ > 0
{-7} pm′`states(s′)

{-8} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃

(address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-9} OK?(ac′`alloc(pm′)(size′)(s′))
{1} (address_block(addr′, size′′) ⊆ ac′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′))))
{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Rewriting using allocator_allocated_alloc, matching in *,

Replacing using formula -1,

Replacing using formula -2,

Rewriting using union_subset3, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_alloc.2.1.

515 C Proof scripts

                                                                                                                        consistent_allocator_alloc.2.2:

{-1} member((addr′, size′′), ai′)
{-2} size′′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} size′ > 0
{-6} pm′`states(s′)

{-7} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-8} OK?(ac′`alloc(pm′)(size′)(s′))
{1} (address_block(addr′, size′′) ⊆ ac′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′))))
{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Instantiating quantified variables,

Simplifying, rewriting, and recording with decision procedures,

Rewriting using allocator_allocated_alloc, matching in *,

Rewriting using subset_bigger_union_left, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_alloc.2.2.

Q.E.D.

C.8.8 Allocation_Info.consistent_allocator_free_TCC1

                                                                                                                        Terse proof for consistent_allocator_free_TCC1.
                                                                                                                        consistent_allocator_free_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address): OK?(ac`free(pm)(addr)(s)) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ pm`states(s) ⊃ up?[posnat](ac`freed_size(pm)(addr)(s))

Repeatedly Skolemizing and flattening,

Rewriting using allocator_free_freed_size, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_free_TCC1.

Q.E.D.

C.8.9 Allocation_Info.consistent_allocator_free_TCC2

                                                                                                                        Terse proof for consistent_allocator_free_TCC2.

516

C.8 Proofs for Allocation_Info (allocators.pvs)

                                                                                                                        consistent_allocator_free_TCC2:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`free(pm)(addr)(s)) ∧ (member((addr, down(ac`freed_size(pm)(addr)(s))), ai) ∨ blocks_pairwise_disjoint(cons((addr, down(ac`freed_size(pm)(addr)(s))), ai))) ⊃ OK?[State, Unit](ac`free(pm)(addr)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr)(s))

Repeatedly Skolemizing and flattening,

                                                                                                                        This completes the proof of consistent_allocator_free_TCC2.

Q.E.D.

C.8.10 Allocation_Info.consistent_allocator_free

                                                                                                                        Terse proof for consistent_allocator_free.
                                                                                                                        consistent_allocator_free:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)), addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`free(pm)(addr)(s)) ∧ (member((addr, down(ac`freed_size(pm)(addr)(s))), ai) ∨ blocks_pairwise_disjoint(cons((addr, down(ac`freed_size(pm)(addr)(s))), ai))) ⊃ consistent_allocator?(pm) (ac, list_remove((addr, down(ac`freed_size(pm)(addr)(s))), ai)) (state(ac`free(pm)(addr)(s)))

Repeatedly Skolemizing and flattening,

Expanding the definition of consistent_allocator?,

Splitting conjunctions,

we get 2 subgoals:

517 C Proof scripts

                                                                                                                        consistent_allocator_free.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)

{-4} allocator_info?(ai′) ∧

(∀ (addr: Address, size: posnat): member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′)))

{-5} OK?(ac′`free(pm′)(addr′)(s′))

{-6} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} allocator_info?(list_remove((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′))

Expanding the definition of allocator_info?,

Rewriting using blocks_pairwise_disjoint_remove, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_free.1.
                                                                                                                        consistent_allocator_free.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)

{-4} allocator_info?(ai′) ∧

(∀ (addr: Address, size: posnat): member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′)))

{-5} OK?(ac′`free(pm′)(addr′)(s′))

{-6} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} ∀ (addr: Address, size: posnat): member((addr, size),

list_remove((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(state(ac′‘free(pm′)(addr′)(s′))))

Repeatedly Skolemizing and flattening,

Rewriting using member_list_remove, matching in *,

Splitting conjunctions,

we get 2 subgoals:

518

C.8 Proofs for Allocation_Info (allocators.pvs)

                                                                                                                        consistent_allocator_free.2.1:

{-1} size′ > 0
{-2} plain_memory?(pm′)
{-3} allocator?(pm′)(ac′)
{-4} pm′`states(s′)
{-5} allocator_info?(ai′)

{-6} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃

(address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-7} OK?(ac′`free(pm′)(addr′)(s′))

{-8} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} true
{2} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(state(ac′‘free(pm′)(addr′)(s′))))

which is trivially true.

                                                                                                                        This completes the proof of consistent_allocator_free.2.1.
                                                                                                                        consistent_allocator_free.2.2:

{-1} ¬ (addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))) ∧

member((addr′′, size′), ai′)

{-2} size′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} pm′`states(s′)
{-6} allocator_info?(ai′)

{-7} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃

(address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-8} OK?(ac′`free(pm′)(addr′)(s′))

{-9} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(state(ac′‘free(pm′)(addr′)(s′))))

Applying disjunctive simplification to flatten sequent,

Instantiating quantified variables,

Simplifying, rewriting, and recording with decision procedures,

Rewriting using allocator_allocated_free, matching in *,

Rewriting using disjoint_subset_difference, matching in *,

Hiding formulas: 3,

Splitting conjunctions,

we get 2 subgoals:

519 C Proof scripts

                                                                                                                        consistent_allocator_free.2.2.1:

{-1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)
{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} allocator_info?(ai′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Expanding the definition of allocator_info?,

Expanding the definition of blocks_pairwise_disjoint,

Instantiating the top quantifier in -7 with the terms: addr′′, addr′, size′, down(ac′‘freed_size(pm′)(addr′)(s′)), Simplifying, rewriting, and recording with decision procedures, Splitting conjunctions, we get 2 subgoals:

                                                                                                                        consistent_allocator_free.2.2.1.1:

{-1} blocks_disjoint?(addr′′, size′, addr′, down(ac′`freed_size(pm′)(addr′)(s′)))
{-2} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)
{-3} member((addr′′, size′), ai′)
{-4} size′ > 0
{-5} plain_memory?(pm′)
{-6} allocator?(pm′)(ac′)
{-7} pm′`states(s′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using blocks_disjoint_disjoint, matching in *,

                                                                                                                        This completes the proof of consistent_allocator_free.2.2.1.1.
                                                                                                                        consistent_allocator_free.2.2.1.2:

{-1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)
{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-8} OK?(ac′`free(pm′)(addr′)(s′))

{1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), list_remove((addr′′, size′), ai′))

{2} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{3} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using member_list_remove, matching in *,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

520

C.8 Proofs for Allocation_Info (allocators.pvs)

This completes the proof of consistent_allocator_free.2.2.1.2.
consistent_allocator_free.2.2.2:

{-1} blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

ai′))

{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} allocator_info?(ai′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Expanding the definition of blocks_pairwise_disjoint, Instantiating the top quantifier in -1 with the terms: addr′, addr′′, down(ac′‘freed_size(pm′)(addr′)(s′)),

size′, Splitting conjunctions, we get 3 subgoals:

consistent_allocator_free.2.2.2.1:

{-1} blocks_disjoint?(addr′, down(ac′`freed_size(pm′)(addr′)(s′)), addr′′, size′)
{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} allocator_info?(ai′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using blocks_disjoint_disjoint, matching in *, Rewriting using disjoint_symmetric, matching in *,

This completes the proof of consistent_allocator_free.2.2.2.1.
consistent_allocator_free.2.2.2.2:

{-1} member((addr′′, size′), ai′)
{-2} size′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} pm′`states(s′)
{-6} allocator_info?(ai′)
{-7} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-8} OK?(ac′`free(pm′)(addr′)(s′))

{1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′))

{2} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{3} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

521 C Proof scripts

Expanding the definition of member,

which is trivially true.

                                                                                                             This completes the proof of consistent_allocator_free.2.2.2.2.
                                                                                                             consistent_allocator_free.2.2.2.3:

{-1} member((addr′′, size′), ai′)
{-2} size′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} pm′`states(s′)
{-6} allocator_info?(ai′)
{-7} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-8} OK?(ac′`free(pm′)(addr′)(s′))

{1} member((addr′′, size′),

list_remove((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{2} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{3} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using member_list_remove, matching in *,

Expanding the definition of member,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                             This completes the proof of consistent_allocator_free.2.2.2.3.

Q.E.D.

C.9 Proofs for Allocation_Table (allocators.pvs)

C.9.1 Allocation_Table.allocation_finite_tree

                                                                                                           Terse proof for allocation_finite_tree.
                                                                                                             allocation_finite_tree:

{1} ∀ (pm: (plain_memory?), at: Allocation_Table(pm)): finite_tree?(at`hierarchy)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of allocation_finite_tree. Q.E.D.

C.9.2 Allocation_Table.allocation_subnodes_allocated_and_free

                                                                                                           Terse proof for allocation_subnodes_allocated_and_free.
                                                                                                             allocation_subnodes_allocated_and_free:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ∧ at`hierarchy`edges(ac1, ac2) ⊃ (ac2‘memory_pool(pm)(s) ⊆ ac1‘allocated(pm)(s)) ∧ block_is_free(ac2`memory_pool(pm)(s), at`info(ac1))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?,

522

C.9 Proofs for Allocation_Table (allocators.pvs)

Applying disjunctive simplification to flatten sequent,

Instantiating quantified variables,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_subnodes_allocated_and_free.

Q.E.D.

C.9.3 Allocation_Table.allocation_subnodes_disjoint

                                                                                                                        Terse proof for allocation_subnodes_disjoint.
                                                                                                                        allocation_subnodes_disjoint:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2, ac3: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ∧ at`hierarchy`edges(ac1, ac2) ∧ at`hierarchy`edges(ac1, ac3) ⊃ ac2 = ac3 ∨ disjoint?(ac2`memory_pool(pm)(s), ac3`memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -9 with the terms: ac1′, ac2′, ac3′, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_subnodes_disjoint.

Q.E.D.

C.9.4 Allocation_Table.allocation_roots_disjoint

                                                                                                                        Terse proof for allocation_roots_disjoint.
                                                                                                                        allocation_roots_disjoint:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (roots(at`hierarchy))): allocation_ok?(pm)(at, s) ⊃ ac1 = ac2 ∨ disjoint?(ac1`memory_pool(pm)(s), ac2`memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_roots_disjoint.

Q.E.D.

C.9.5 Allocation_Table.allocation_private_memory_disjoint

                                                                                                                        Terse proof for allocation_private_memory_disjoint.
                                                                                                                        allocation_private_memory_disjoint:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ⊃ ac1 = ac2 ∨ disjoint?(ac1`private_mem(pm), ac2`private_mem(pm))

523 C Proof scripts

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_private_memory_disjoint.

Q.E.D.

C.9.6 Allocation_Table.allocation_consistent_allocator

                                                                                                                        Terse proof for allocation_consistent_allocator.
                                                                                                                        allocation_consistent_allocator:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ⊃ consistent_allocator?(pm)(ac, at`info(ac))(s)

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables,

                                                                                                                        This completes the proof of allocation_consistent_allocator.

Q.E.D.

C.9.7 Allocation_Table.allocation_allocated_allocation_point

                                                                                                                        Terse proof for allocation_allocated_allocation_point.
                                                                                                                        allocation_allocated_allocation_point:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

addr: Address, size: posnat): allocation_ok?(pm)(at, s) ∧ member((addr, size), at`info(ac)) ⊃ (address_block(addr, size) ⊆ ac‘allocated(pm)(s))

Repeatedly Skolemizing and flattening,

Using lemma allocation_consistent_allocator,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of consistent_allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_allocated_allocation_point.

Q.E.D.

C.9.8 Allocation_Table.allocation_allocation_point_in_memory_pool

                                                                                                                        Terse proof for allocation_allocation_point_in_memory_pool.
                                                                                                                        allocation_allocation_point_in_memory_pool:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

addr: Address, size: posnat): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ member((addr, size), at`info(ac)) ⊃ (address_block(addr, size) ⊆ ac‘memory_pool(pm)(s))

524

C.9 Proofs for Allocation_Table (allocators.pvs)

Repeatedly Skolemizing and flattening,

Using lemma allocation_allocated_allocation_point,

Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_subset_allocated_memory_pool, Simplifying, rewriting, and recording with decision procedures, Forward chaining on subset_transitive,

                                                                                                                        This completes the proof of allocation_allocation_point_in_memory_pool.

Q.E.D.

C.9.9 Allocation_Table.allocators_different_in_hierachy

                                                                                                                        Terse proof for allocators_different_in_hierachy.
                                                                                                                        allocators_different_in_hierachy:

{1} ∀ (pm: (plain_memory?), at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes)): at`hierarchy`edges(ac1, ac2) ⊃ ¬ ac1 = ac2

Repeatedly Skolemizing and flattening,

Using lemma different_nodes_on_edge[(allocator?(pm′))], Simplifying, rewriting, and recording with decision procedures, Adding type constraints for at!1‘hierarchy, Expanding the definition of finite_tree?, Expanding the definition of tree?, which is trivially true.

                                                                                                                        This completes the proof of allocators_different_in_hierachy.

Q.E.D.

C.9.10 Allocation_Table.uppath_memory_pool

                                                                                                                        Terse proof for uppath_memory_pool.
                                                                                                                        uppath_memory_pool:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), p: (path?(at`hierarchy))): allocation_ok?(pm)(at, s) ∧ pm`states(s) ⊃ (path_end(p)‘memory_pool(pm)(s) ⊆ path_start(p)‘memory_pool(pm)(s))

For the top quantifier in 1, we introduce Skolem constants: (pm′ s′ at′ ),

Inducting on p on formula 1 using induction scheme path_list_induction[(allocator?(pm′))], we get 3 subgoals:

                                                                                                                        uppath_memory_pool.1:

{-1} allocation_ok?(pm′)(at′, s′)
{-2} pm′`states(s′)
{1} path?(at′`hierarchy)(p′)
{2} (path_end(p′)‘memory_pool(pm′)(s′) ⊆ path_start(p′)‘memory_pool(pm′)(s′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of uppath_memory_pool.1.

525 C Proof scripts

                                                                                                                        uppath_memory_pool.2:

{1} ∀ (t: ((allocator?(pm′)))):

path?(at′`hierarchy)(cons(t, null)) ⊃ allocation_ok?(pm′)(at′, s′) ∧ pm′`states(s′) ⊃ (path_end(cons(t, null))‘memory_pool(pm′)(s′) ⊆ path_start(cons(t, null))‘memory_pool(pm′)(s′))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: path_start path_end length nth subset_reflexive Simplifying, rewriting, and recording with decision procedures, This completes the proof of uppath_memory_pool.2.

                                                                                                                        uppath_memory_pool.3:

{1} ∀ (t: ((allocator?(pm′))), tail: (path_list?)):

(path?(at′`hierarchy)(tail) ⊃ allocation_ok?(pm′)(at′, s′) ∧ pm′`states(s′) ⊃ (path_end(tail)‘memory_pool(pm′)(s′) ⊆ path_start(tail)‘memory_pool(pm′)(s′)))

⊃

path?(at′`hierarchy)(cons(t, tail)) ⊃

allocation_ok?(pm′)(at′, s′) ∧ pm′`states(s′) ⊃

(path_end(cons(t, tail))‘memory_pool(pm′)(s′) ⊆ path_start(cons(t, tail))‘memory_pool(pm′)(s′))

Repeatedly Skolemizing and flattening,

Using lemma path_cdr,

Simplifying, rewriting, and recording with decision procedures,

Installing automatic rewrites from: path_start nth length path_list? path_end Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -7 with the terms: 0, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_subnodes_allocated_and_free, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, Forward chaining on subset_transitive, Hiding formulas: -2, -7, Using lemma allocator_subset_allocated_memory_pool, Simplifying, rewriting, and recording with decision procedures, Forward chaining on subset_transitive, This completes the proof of uppath_memory_pool.3. Q.E.D.

C.9.11

Allocation_Table.uppath_memory_pool_allocated_and_free_TCC1

                                                                                                                        Terse proof for uppath_memory_pool_allocated_and_free_TCC1.

526

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        uppath_memory_pool_allocated_and_free_TCC1:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), p: (path?[((allocator?(pm)))](at`hierarchy))):

(path_end(p)‘memory_pool(pm)(s) ⊆ path_start(p)‘allocated(pm)(s)) ∧ pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ length(p) ≥ 2 ⊃ at`hierarchy`nodes(path_start[((allocator?(pm)))](p))

Repeatedly Skolemizing and flattening,

Rewriting using nodes_path_start, matching in *,

                                                                                                                        This completes the proof of uppath_memory_pool_allocated_and_free_TCC1.

Q.E.D.

C.9.12 Allocation_Table.uppath_memory_pool_allocated_and_free

                                                                                                                        Terse proof for uppath_memory_pool_allocated_and_free.
                                                                                                                        uppath_memory_pool_allocated_and_free:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), p: (path?(at`hierarchy))): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ length(p) ≥ 2 ⊃ (path_end(p)‘memory_pool(pm)(s) ⊆ path_start(p)‘allocated(pm)(s)) ∧ block_is_free(path_end(p)`memory_pool(pm)(s), at`info(path_start(p)))

Repeatedly Skolemizing and flattening,

Using lemma path_cdr,

Installing automatic rewrites from: path_list? length_cdr path_end path_start nth subset_reflexive Simplifying, rewriting, and recording with decision procedures, Using lemma uppath_memory_pool, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -7 with the terms: 0, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_subnodes_allocated_and_free, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Forward chaining on subset_transitive, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -1, -2, Expanding the definition of block_is_free, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of uppath_memory_pool_allocated_and_free.

Q.E.D.

C.9.13 Allocation_Table.allocation_memory_pools

                                                                                                                        Terse proof for allocation_memory_pools.

527 C Proof scripts

                                                                                                                        allocation_memory_pools:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (at`hierarchy`nodes)): pm`states(s) ∧ allocation_ok?(pm)(at, s) ⊃ ac1 = ac2 ∨ disjoint?(ac1`memory_pool(pm)(s), ac2`memory_pool(pm)(s)) ∨ ((ac1‘memory_pool(pm)(s) ⊆ ac2‘allocated(pm)(s)) ∧

block_is_free(ac1`memory_pool(pm)(s), at`info(ac2))) ∨ ((ac2‘memory_pool(pm)(s) ⊆ ac1‘allocated(pm)(s)) ∧

block_is_free(ac2`memory_pool(pm)(s), at`info(ac1)))

Repeatedly Skolemizing and flattening,

Using lemma symmetric_node_pair_distinction[(allocator?(pm′))],

Splitting conjunctions,

we get 7 subgoals:

                                                                                                                        allocation_memory_pools.1:

{-1} ∀ (n1_1, n2_1: (at′`hierarchy`nodes)):

n1_1 = n2_1 ∨

disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{-2} plain_memory?(pm′)
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} pm′`states(s′)
{-8} allocation_ok?(pm′)(at′, s′)
{1} ac1′ = ac2′
{2} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{3} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{4} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of allocation_memory_pools.1.

528

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        allocation_memory_pools.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)
{1} true
{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

which is trivially true.

                                                                                                                        This completes the proof of allocation_memory_pools.2.
                                                                                                                        allocation_memory_pools.3:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)
{1} symmetric?(λ (n_{1}, n_{2}: (at′`hierarchy`nodes)):
n_{1} = n_{2} ∨

disjoint?(n_{1}`memory_pool(pm′)(s′), n_{2}`memory_pool(pm′)(s′)) ∨ ((n_{1}‘memory_pool(pm′)(s′) ⊆ n_{2}‘allocated(pm′)(s′)) ∧

block_is_free(n_{1}`memory_pool(pm′)(s′), at′`info(n_{2}))) ∨ ((n_{2}‘memory_pool(pm′)(s′) ⊆ n_{1}‘allocated(pm′)(s′)) ∧

block_is_free(n_{2}`memory_pool(pm′)(s′), at′`info(n_{1}))))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping 1 and hiding *,

Expanding the definition of symmetric?,

Repeatedly Skolemizing and flattening,

Using lemma disjoint_symmetric,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of allocation_memory_pools.3.

529 C Proof scripts

                                                                                                                        allocation_memory_pools.4:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)
{1} ∀ (n: (at′`hierarchy`nodes)): true
{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_memory_pools.4.
                                                                                                                        allocation_memory_pools.5:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)

{1} ∀ (n1_1, n2_1: (at′`hierarchy`nodes), p: (path?(at′`hierarchy))): ¬ n1_1 = n2_1 ∧ path_start(p) = n2_1 ∧ path_end(p) = n1_1 ∧ length(p) ≥ 2 ⊃ n1_1 = n2_1 ∨ disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping (-6 -7 1) and hiding *,

Repeatedly Skolemizing and flattening,

Using lemma uppath_memory_pool_allocated_and_free,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of allocation_memory_pools.5.

530

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        allocation_memory_pools.6:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)

{1} ∀ (n1_1, n2_1: (at′`hierarchy`nodes), p_{1}, p_{2}: (path?(at′`hierarchy))): ¬ n1_1 = n2_1 ∧ root_path(at′`hierarchy, n1_1)(p_{1}) ∧ root_path(at′`hierarchy, n2_1)(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2}) ⊃ n1_1 = n2_1 ∨ disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping (-6 -7 1) and hiding *,

Repeatedly Skolemizing and flattening,

Hiding formulas: 5, 6,

Using lemma uppath_memory_pool,

Using lemma uppath_memory_pool,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of root_path,

Applying disjunctive simplification to flatten sequent,

Using lemma allocation_roots_disjoint,

Simplifying, rewriting, and recording with decision procedures,

Forward chaining on disjoint_mono,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_memory_pools.6.

531 C Proof scripts

                                                                                                                        allocation_memory_pools.7:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)
{1} ∀ (n1_1, n2_1, n_{3}: (at′`hierarchy`nodes), p_{1}, p_{2}: (path?(at′`hierarchy))):

¬ n1_1 = n2_1 ∧ ¬ n1_1 = n_{3} ∧ ¬ n2_1 = n_{3} ∧ at′`hierarchy`edges(n_{3}, path_start(p_{1})) ∧ at′`hierarchy`edges(n_{3}, path_start(p_{2})) ∧ path_end(p_{1}) = n1_1 ∧ path_end(p_{2}) = n2_1 ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃

n1_1 = n2_1 ∨

disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping (-6 -7 1) and hiding *,

Repeatedly Skolemizing and flattening,

Hiding formulas: 7, 8,

Using lemma uppath_memory_pool, Using lemma uppath_memory_pool, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_subnodes_disjoint, Simplifying, rewriting, and recording with decision procedures, Forward chaining on disjoint_mono, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_memory_pools.7.

Q.E.D.

C.9.14 Allocation_Table.allocation_info_TCC1

                                                                                                                        Terse proof for allocation_info_TCC1.
                                                                                                                        allocation_info_TCC1:

{1} ∀ (pm: (plain_memory?[State]), at: Allocation_Table(pm)):

is_finite[(at`hierarchy`nodes)]

(restrict[((allocator?(pm))), (at`hierarchy`nodes), boolean] (at`hierarchy`nodes))

532

C.9 Proofs for Allocation_Table (allocators.pvs)

Repeatedly Skolemizing and flattening, Adding type constraints for at!1‘hierarchy, Expanding the definition of finite_tree?, Applying disjunctive simplification to flatten sequent, Expanding the definition of finite?, Hiding formulas: -2, -3, Expanding the definition of restrict, Expanding the definition of is_finite, which is trivially true. This completes the proof of allocation_info_TCC1. Q.E.D.

C.9.15 Allocation_Table.member_allocation_info

                                                                                                                        Terse proof for member_allocation_info.
                                                                                                                        member_allocation_info:

{1} ∀ (pm: (plain_memory?), at: Allocation_Table(pm), addr: Address, size: posnat): member((addr, size), allocation_info(pm)(at)) ⊃ (∃ (ac: (at`hierarchy`nodes)): member((addr, size), at`info(ac)))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_info, Using lemma member_flatten[[Address, posnat]], Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -4, Repeatedly Skolemizing and flattening, Using lemma member_map, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -2, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of member_allocation_info. Q.E.D.

C.9.16 Allocation_Table.allocation_consistent

                                                                                                                        Terse proof for allocation_consistent.
                                                                                                                        allocation_consistent:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm)):

pm`states(s) ∧ allocation_ok?(pm)(at, s) ⊃ allocator_info?(allocation_info(pm)(at))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator_info?, Expanding the definition of blocks_pairwise_disjoint, Repeatedly Skolemizing and flattening, Rewriting using member_list_remove, matching in *, Splitting conjunctions, we get 2 subgoals:

533 C Proof scripts

                                                                                                                        allocation_consistent.1:

{-1} size′ > 0
{-2} size′′ > 0
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} allocation_ok?(pm′)(at′, s′)
{-6} member((addr′, size′), allocation_info(pm′)(at′))
{1} true
{2} blocks_disjoint?(addr′, size′, addr′′, size′′)

which is trivially true.

This completes the proof of allocation_consistent.1.

                                                                                                                        allocation_consistent.2:

{-1} ¬ (addr′′ = addr′ ∧ size′′ = size′) ∧

member((addr′′, size′′), allocation_info(pm′)(at′))

{-2} size′ > 0
{-3} size′′ > 0
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} member((addr′, size′), allocation_info(pm′)(at′))
{1} blocks_disjoint?(addr′, size′, addr′′, size′′)

Applying disjunctive simplification to flatten sequent,

Forward chaining on member_allocation_info, Forward chaining on member_allocation_info, Hiding formulas: -3, -9, Repeatedly Skolemizing and flattening, Using lemma allocation_memory_pools, Simplifying, rewriting, and recording with decision procedures, Splitting conjunctions, we get 4 subgoals:

                                                                                                                        allocation_consistent.2.1:

{-1} ac′ = ac′′
{-2} allocator?(pm′)(ac′′)
{-3} at′`hierarchy`nodes(ac′′)
{-4} allocator?(pm′)(ac′)
{-5} at′`hierarchy`nodes(ac′)
{-6} member((addr′, size′), at′`info(ac′))
{-7} member((addr′′, size′′), at′`info(ac′′))
{-8} size′ > 0
{-9} size′′ > 0
{-10} plain_memory?(pm′)
{-11} pm′`states(s′)
{-12} allocation_ok?(pm′)(at′, s′)
{1} addr =  ∧  =

′′ addr^′ size^{′′} size^′ {2} blocks_disjoint?(addr^′, size^′, addr^{′′}, size^{′′})

Using lemma allocation_consistent_allocator,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of consistent_allocator?, Applying disjunctive simplification to flatten sequent,

534

C.9 Proofs for Allocation_Table (allocators.pvs)

Hiding formulas: -2,

Expanding the definition of allocator_info?,

Expanding the definition of blocks_pairwise_disjoint,

Instantiating quantified variables,

Rewriting using member_list_remove, matching in *,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of allocation_consistent.2.1.
                                                                                                                        allocation_consistent.2.2:

{-1} disjoint?(ac^′`memory_pool(pm^′)(s^′), ac^{′′}`memory_pool(pm^′)(s^′))

{-2} allocator?(pm^′)(ac^{′′}) {-3} at^′`hierarchy`nodes(ac^{′′}) {-4} allocator?(pm^′)(ac^′) {-5} at^′`hierarchy`nodes(ac^′) {-6} member((addr^′, size^′), at^′`info(ac^′)) {-7} member((addr^{′′}, size^{′′}), at^′`info(ac^{′′})) {-8} size^′ > 0 {-9} size^{′′} > 0 {-10} plain_memory?(pm^′) {-11} pm^′`states(s^′) {-12} allocation_ok?(pm^′)(at^′, s^′) {1} addr^{′′} = addr^′ ∧ size^{′′} = size^′ {2} blocks_disjoint?(addr^′, size^′, addr^{′′}, size^{′′})

Rewriting using blocks_disjoint_disjoint, matching in *, Using lemma allocation_allocation_point_in_memory_pool, Using lemma allocation_allocation_point_in_memory_pool, Simplifying, rewriting, and recording with decision procedures, Forward chaining on disjoint_mono,

                                                                                                                        This completes the proof of allocation_consistent.2.2.
                                                                                                                        allocation_consistent.2.3:

{-1} ((ac^′‘memory_pool(pm^′)(s^′) ⊆ ac^{′′}‘allocated(pm^′)(s^′)) ∧

block_is_free(ac^′`memory_pool(pm^′)(s^′), at^′`info(ac^{′′})))

{-2} allocator?(pm^′)(ac^{′′}) {-3} at^′`hierarchy`nodes(ac^{′′}) {-4} allocator?(pm^′)(ac^′) {-5} at^′`hierarchy`nodes(ac^′) {-6} member((addr^′, size^′), at^′`info(ac^′)) {-7} member((addr^{′′}, size^{′′}), at^′`info(ac^{′′})) {-8} size^′ > 0 {-9} size^{′′} > 0 {-10} plain_memory?(pm^′) {-11} pm^′`states(s^′) {-12} allocation_ok?(pm^′)(at^′, s^′) {1} addr^{′′} = addr^′ ∧ size^{′′} = size^′ {2} blocks_disjoint?(addr^′, size^′, addr^{′′}, size^{′′})

Applying disjunctive simplification to flatten sequent, Rewriting using blocks_disjoint_disjoint, matching in *, Using lemma allocation_allocation_point_in_memory_pool, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of block_is_free, Instantiating the top quantifier in -3 with the terms: addr^{′′}, size^{′′},

535 C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -2,

Using lemma disjoint_mono,

Installing automatic rewrites from: subset_reflexive

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_consistent.2.3.
                                                                                                                        allocation_consistent.2.4:

{-1} ((ac^{′′}‘memory_pool(pm^′)(s^′) ⊆ ac^′‘allocated(pm^′)(s^′)) ∧

block_is_free(ac^{′′}`memory_pool(pm^′)(s^′), at^′`info(ac^′)))

{-2} allocator?(pm^′)(ac^{′′}) {-3} at^′`hierarchy`nodes(ac^{′′}) {-4} allocator?(pm^′)(ac^′) {-5} at^′`hierarchy`nodes(ac^′) {-6} member((addr^′, size^′), at^′`info(ac^′)) {-7} member((addr^{′′}, size^{′′}), at^′`info(ac^{′′})) {-8} size^′ > 0 {-9} size^{′′} > 0 {-10} plain_memory?(pm^′) {-11} pm^′`states(s^′) {-12} allocation_ok?(pm^′)(at^′, s^′) {1} addr^{′′} = addr^′ ∧ size^{′′} = size^′ {2} blocks_disjoint?(addr^′, size^′, addr^{′′}, size^{′′})

Applying disjunctive simplification to flatten sequent,

Hiding formulas: -1,

Rewriting using blocks_disjoint_disjoint, matching in *,

Using lemma allocation_allocation_point_in_memory_pool,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of block_is_free,

Instantiating the top quantifier in -2 with the terms: addr^′, size^′,

Simplifying, rewriting, and recording with decision procedures,

Using lemma disjoint_mono,

Installing automatic rewrites from: subset_reflexive

Simplifying, rewriting, and recording with decision procedures,

Rewriting using disjoint_symmetric, matching in *,

                                                                                                                        This completes the proof of allocation_consistent.2.4.

Q.E.D.

C.9.17

Allocation_Table.allocation_alloc_other_private_memory_TCC1

                                                                                                                        Terse proof for allocation_alloc_other_private_memory_TCC1.

536

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        allocation_alloc_other_private_memory_TCC1:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes), size: posnat):

pm`states(s) ∧

allocation_ok?(pm)(at, s) ∧ OK?(ac1`alloc(pm)(size)(s)) ∧ ¬ data(ac1`alloc(pm)(size)(s)) = null_address ∧ ¬ ac1 = ac2

⊃

OK?[State, Address](ac1`alloc(pm)(size)(s)) ∨

Exception?[State, Address](ac1`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of allocation_alloc_other_private_memory_TCC1.

Q.E.D.

C.9.18

Allocation_Table.allocation_alloc_other_private_memory_TCC2

                                                                                                                        Terse proof for allocation_alloc_other_private_memory_TCC2.
                                                                                                                        allocation_alloc_other_private_memory_TCC2:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes), size: posnat):

pm`states(s) ∧

allocation_ok?(pm)(at, s) ∧ OK?(ac1`alloc(pm)(size)(s)) ∧ ¬ data(ac1`alloc(pm)(size)(s)) = null_address ∧ ¬ ac1 = ac2

⊃ pm`states(state[State, Address](ac1`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening,

Rewriting using allocator_next_state_alloc, matching in *,

Expanding the definition of has_next_state,

which is trivially true.

                                                                                                                        This completes the proof of allocation_alloc_other_private_memory_TCC2.

Q.E.D.

C.9.19 Allocation_Table.allocation_alloc_other_private_memory

                                                                                                                        Terse proof for allocation_alloc_other_private_memory.
                                                                                                                        allocation_alloc_other_private_memory:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes), size: posnat):

pm`states(s) ∧

allocation_ok?(pm)(at, s) ∧ OK?(ac1`alloc(pm)(size)(s)) ∧ ¬ data(ac1`alloc(pm)(size)(s)) = null_address ∧ ¬ ac1 = ac2

⊃ stays_unchanged(pm)(s, state(ac1`alloc(pm)(size)(s)), ac2`private_mem(pm))

Repeatedly Skolemizing and flattening,

537 C Proof scripts

Using lemma allocator_only_changes_alloc,

Simplifying, rewriting, and recording with decision procedures,

Using lemma stays_unchanged_only_changes_disjoint,

Installing automatic rewrites from: allocator_next_state_alloc allocator_subset_private_memory_plain_memory has_next_state

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocation_private_memory_disjoint,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocation_alloc_other_private_memory.

Q.E.D.

C.9.20 Allocation_Table.allocation_alloc_TCC1

                                                                                                                        Terse proof for allocation_alloc_TCC1.
                                                                                                                        allocation_alloc_TCC1:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

size: posnat): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of allocation_alloc_TCC1. Q.E.D.

C.9.21 Allocation_Table.allocation_alloc

                                                                                                                        Terse proof for allocation_alloc.
                                                                                                                        allocation_alloc:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

size: posnat): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ allocation_ok?(pm)

(at

with [`info(ac)

:= cons((data(ac`alloc(pm)(size)(s)), size),

at`info(ac))],

state(ac`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: allocator_next_state_alloc has_next_state subset_bigger_union_left allocator_memory_pool_alloc allocator_allocated_alloc subset_equal

Expanding the definition of allocation_ok?,

Applying propositional simplification,

538

C.9 Proofs for Allocation_Table (allocators.pvs)

we get 5 subgoals:

                                                                                                                        allocation_alloc.1:

{-1} plain_memory?(pm^′) {-2} allocator?(pm^′)(ac^′) {-3} at^′`hierarchy`nodes(ac^′) {-4} size^′ > 0 {-5} pm^′`states(s^′) {-6} allocation_ok?(pm^′)(at^′, s^′) {-7} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ∀ (ac1, ac2: (at^′`hierarchy`nodes)):

at^′`hierarchy`edges(ac1, ac2) ⊃

(ac2‘memory_pool(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))) ⊆ ac1‘allocated(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′)))) ∧ block_is_free(ac2`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac1))

{2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Repeatedly Skolemizing and flattening,

Using lemma allocation_subnodes_allocated_and_free, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Case splitting on ac!1 = ac2!1, we get 2 subgoals:

                                                                                                                        allocation_alloc.1.1:

{-1} ac^′ = ac2^′

{-2} (ac2^′‘memory_pool(pm^′)(s^′) ⊆ ac1^′‘allocated(pm^′)(s^′))

{-3} block_is_free(ac2^′`memory_pool(pm^′)(s^′), at^′`info(ac1^′))

{-4} allocator?(pm^′)(ac1^′) {-5} at^′`hierarchy`nodes(ac1^′) {-6} allocator?(pm^′)(ac2^′) {-7} at^′`hierarchy`nodes(ac2^′) {-8} at^′`hierarchy`edges(ac1^′, ac2^′) {-9} plain_memory?(pm^′) {-10} allocator?(pm^′)(ac^′) {-11} at^′`hierarchy`nodes(ac^′) {-12} size^′ > 0 {-13} pm^′`states(s^′) {-14} allocation_ok?(pm^′)(at^′, s^′) {-15} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} (ac2^′‘memory_pool(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))) ⊆ ac1^′‘allocated(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))))

∧

block_is_free(ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac1^′))

{2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

539 C Proof scripts

Replacing using formula -1,

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocators_different_in_hierachy,

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocator_const_private_memory_allocated,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_alloc.1.1.

                                                                                                                        allocation_alloc.1.2:

{-1} (ac2^′‘memory_pool(pm^′)(s^′) ⊆ ac1^′‘allocated(pm^′)(s^′))

{-2} block_is_free(ac2^′`memory_pool(pm^′)(s^′), at^′`info(ac1^′))

{-3} allocator?(pm^′)(ac1^′) {-4} at^′`hierarchy`nodes(ac1^′) {-5} allocator?(pm^′)(ac2^′) {-6} at^′`hierarchy`nodes(ac2^′) {-7} at^′`hierarchy`edges(ac1^′, ac2^′) {-8} plain_memory?(pm^′) {-9} allocator?(pm^′)(ac^′) {-10} at^′`hierarchy`nodes(ac^′) {-11} size^′ > 0 {-12} pm^′`states(s^′) {-13} allocation_ok?(pm^′)(at^′, s^′) {-14} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac^′ = ac2^′ {2} (ac2^′‘memory_pool(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))) ⊆ ac1^′‘allocated(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))))

∧

block_is_free(ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac1^′))

{3} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocator_const_private_memory_memory_pool,

Simplifying, rewriting, and recording with decision procedures,

Replacing using formula -1,

Hiding formulas: -1,

Case splitting on ac1!1 = ac!1,

we get 2 subgoals:

540

C.9 Proofs for Allocation_Table (allocators.pvs)

allocation_alloc.1.2.1:

{-1} ac1^′ = ac^′ {-2} stays_unchanged(pm^′)

(s^′, state(ac^′`alloc(pm^′)(size^′)(s^′)), ac2^′`private_mem(pm^′))

{-3} (ac2^′‘memory_pool(pm^′)(s^′) ⊆ ac1^′‘allocated(pm^′)(s^′)) {-4} block_is_free(ac2^′`memory_pool(pm^′)(s^′), at^′`info(ac1^′)) {-5} allocator?(pm^′)(ac1^′) {-6} at^′`hierarchy`nodes(ac1^′) {-7} allocator?(pm^′)(ac2^′) {-8} at^′`hierarchy`nodes(ac2^′) {-9} at^′`hierarchy`edges(ac1^′, ac2^′) {-10} plain_memory?(pm^′) {-11} allocator?(pm^′)(ac^′) {-12} at^′`hierarchy`nodes(ac^′) {-13} size^′ > 0 {-14} pm^′`states(s^′) {-15} allocation_ok?(pm^′)(at^′, s^′) {-16} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac^′ = ac2^′ {2} (ac2^′‘memory_pool(pm^′)(s^′) ⊆ ac1^′‘allocated(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))))

∧

block_is_free(ac2^′`memory_pool(pm^′)(s^′), at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac1^′))

{3} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Replacing using formula -1,

Simplifying, rewriting, and recording with decision procedures,

Rewriting using block_is_free_add, matching in *,

Using lemma allocator_alloc_disjoint,

Simplifying, rewriting, and recording with decision procedures,

Using lemma disjoint_mono,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_alloc.1.2.1.

541 C Proof scripts

                                                                                                             allocation_alloc.1.2.2:

{-1} stays_unchanged(pm^′)

(s^′, state(ac^′`alloc(pm^′)(size^′)(s^′)), ac2^′`private_mem(pm^′))

{-2} (ac2^′‘memory_pool(pm^′)(s^′) ⊆ ac1^′‘allocated(pm^′)(s^′))

{-3} block_is_free(ac2^′`memory_pool(pm^′)(s^′), at^′`info(ac1^′))

{-4} allocator?(pm^′)(ac1^′) {-5} at^′`hierarchy`nodes(ac1^′) {-6} allocator?(pm^′)(ac2^′) {-7} at^′`hierarchy`nodes(ac2^′) {-8} at^′`hierarchy`edges(ac1^′, ac2^′) {-9} plain_memory?(pm^′) {-10} allocator?(pm^′)(ac^′) {-11} at^′`hierarchy`nodes(ac^′) {-12} size^′ > 0 {-13} pm^′`states(s^′) {-14} allocation_ok?(pm^′)(at^′, s^′) {-15} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac1^′ = ac^′ {2} ac^′ = ac2^′ {3} (ac2^′‘memory_pool(pm^′)(s^′) ⊆ ac1^′‘allocated(pm^′)(state(ac^′‘alloc(pm^′)(size^′)(s^′))))

∧

block_is_free(ac2^′`memory_pool(pm^′)(s^′), at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac1^′))

{4} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_allocated, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.1.2.2.

                                                                                                             allocation_alloc.2:

{-1} plain_memory?(pm^′) {-2} allocator?(pm^′)(ac^′) {-3} at^′`hierarchy`nodes(ac^′) {-4} size^′ > 0 {-5} pm^′`states(s^′) {-6} allocation_ok?(pm^′)(at^′, s^′) {-7} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ∀ (ac1, ac2, ac3: (at^′`hierarchy`nodes)):

at^′`hierarchy`edges(ac1, ac2) ∧ at^′`hierarchy`edges(ac1, ac3) ⊃

ac2 = ac3 ∨

disjoint?(ac2`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac3`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_subnodes_disjoint, Simplifying, rewriting, and recording with decision procedures, Case splitting on ac2!1 = ac!1,

542

C.9 Proofs for Allocation_Table (allocators.pvs)

we get 2 subgoals:

                                                                                                                        allocation_alloc.2.1:

{-1} ac2^′ = ac^′

{-2} disjoint?(ac2^′`memory_pool(pm^′)(s^′), ac3^′`memory_pool(pm^′)(s^′))

{-3} allocator?(pm^′)(ac1^′) {-4} at^′`hierarchy`nodes(ac1^′) {-5} allocator?(pm^′)(ac2^′) {-6} at^′`hierarchy`nodes(ac2^′) {-7} allocator?(pm^′)(ac3^′) {-8} at^′`hierarchy`nodes(ac3^′) {-9} at^′`hierarchy`edges(ac1^′, ac2^′) {-10} at^′`hierarchy`edges(ac1^′, ac3^′) {-11} plain_memory?(pm^′) {-12} allocator?(pm^′)(ac^′) {-13} at^′`hierarchy`nodes(ac^′) {-14} size^′ > 0 {-15} pm^′`states(s^′) {-16} allocation_ok?(pm^′)(at^′, s^′) {-17} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac2^′ = ac3^′ {2} disjoint?(ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac3^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{3} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Replacing using formula -1,

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.2.1.

                                                                                                                        allocation_alloc.2.2:

{-1} disjoint?(ac2^′`memory_pool(pm^′)(s^′), ac3^′`memory_pool(pm^′)(s^′))

{-2} allocator?(pm^′)(ac1^′) {-3} at^′`hierarchy`nodes(ac1^′) {-4} allocator?(pm^′)(ac2^′) {-5} at^′`hierarchy`nodes(ac2^′) {-6} allocator?(pm^′)(ac3^′) {-7} at^′`hierarchy`nodes(ac3^′) {-8} at^′`hierarchy`edges(ac1^′, ac2^′) {-9} at^′`hierarchy`edges(ac1^′, ac3^′) {-10} plain_memory?(pm^′) {-11} allocator?(pm^′)(ac^′) {-12} at^′`hierarchy`nodes(ac^′) {-13} size^′ > 0 {-14} pm^′`states(s^′) {-15} allocation_ok?(pm^′)(at^′, s^′) {-16} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac2^′ = ac^′ {2} ac2^′ = ac3^′ {3} disjoint?(ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac3^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{4} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

543 C Proof scripts

Case splitting on ac3!1 = ac!1,

we get 2 subgoals:

                                                                                                                        allocation_alloc.2.2.1:

{-1} ac3^′ = ac^′

{-2} disjoint?(ac2^′`memory_pool(pm^′)(s^′), ac3^′`memory_pool(pm^′)(s^′))

{-3} allocator?(pm^′)(ac1^′) {-4} at^′`hierarchy`nodes(ac1^′) {-5} allocator?(pm^′)(ac2^′) {-6} at^′`hierarchy`nodes(ac2^′) {-7} allocator?(pm^′)(ac3^′) {-8} at^′`hierarchy`nodes(ac3^′) {-9} at^′`hierarchy`edges(ac1^′, ac2^′) {-10} at^′`hierarchy`edges(ac1^′, ac3^′) {-11} plain_memory?(pm^′) {-12} allocator?(pm^′)(ac^′) {-13} at^′`hierarchy`nodes(ac^′) {-14} size^′ > 0 {-15} pm^′`states(s^′) {-16} allocation_ok?(pm^′)(at^′, s^′) {-17} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac2^′ = ac^′ {2} ac2^′ = ac3^′ {3} disjoint?(ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac3^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{4} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Replacing using formula -1,

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocator_const_private_memory_memory_pool,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_alloc.2.2.1.

544

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        allocation_alloc.2.2.2:

{-1} disjoint?(ac2^′`memory_pool(pm^′)(s^′), ac3^′`memory_pool(pm^′)(s^′))

{-2} allocator?(pm^′)(ac1^′) {-3} at^′`hierarchy`nodes(ac1^′) {-4} allocator?(pm^′)(ac2^′) {-5} at^′`hierarchy`nodes(ac2^′) {-6} allocator?(pm^′)(ac3^′) {-7} at^′`hierarchy`nodes(ac3^′) {-8} at^′`hierarchy`edges(ac1^′, ac2^′) {-9} at^′`hierarchy`edges(ac1^′, ac3^′) {-10} plain_memory?(pm^′) {-11} allocator?(pm^′)(ac^′) {-12} at^′`hierarchy`nodes(ac^′) {-13} size^′ > 0 {-14} pm^′`states(s^′) {-15} allocation_ok?(pm^′)(at^′, s^′) {-16} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac3^′ = ac^′ {2} ac2^′ = ac^′ {3} ac2^′ = ac3^′ {4} disjoint?(ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac3^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{5} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Using lemma allocation_alloc_other_private_memory, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.2.2.2.

                                                                                                                        allocation_alloc.3:

{-1} plain_memory?(pm^′) {-2} allocator?(pm^′)(ac^′) {-3} at^′`hierarchy`nodes(ac^′) {-4} size^′ > 0 {-5} pm^′`states(s^′) {-6} allocation_ok?(pm^′)(at^′, s^′) {-7} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ∀ (ac1, ac2: (roots(at^′`hierarchy))):

ac1 = ac2 ∨ disjoint?(ac1`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac2`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_roots_disjoint, Simplifying, rewriting, and recording with decision procedures, Case splitting on ac1!1 = ac!1, we get 2 subgoals:

545 C Proof scripts

                                                                                                                        allocation_alloc.3.1:

{-1} ac1^′ = ac^′

{-2} disjoint?(ac1^′`memory_pool(pm^′)(s^′), ac2^′`memory_pool(pm^′)(s^′))

{-3} allocator?(pm^′)(ac1^′) {-4} at^′`hierarchy`nodes(ac1^′) {-5} roots(at^′`hierarchy)(ac1^′) {-6} allocator?(pm^′)(ac2^′) {-7} at^′`hierarchy`nodes(ac2^′) {-8} roots(at^′`hierarchy)(ac2^′) {-9} plain_memory?(pm^′) {-10} allocator?(pm^′)(ac^′) {-11} at^′`hierarchy`nodes(ac^′) {-12} size^′ > 0 {-13} pm^′`states(s^′) {-14} allocation_ok?(pm^′)(at^′, s^′) {-15} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac1^′ = ac2^′ {2} disjoint?(ac1^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{3} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Replacing using formula -1,

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.3.1.

                                                                                                                        allocation_alloc.3.2:

{-1} disjoint?(ac1^′`memory_pool(pm^′)(s^′), ac2^′`memory_pool(pm^′)(s^′))

{-2} allocator?(pm^′)(ac1^′) {-3} at^′`hierarchy`nodes(ac1^′) {-4} roots(at^′`hierarchy)(ac1^′) {-5} allocator?(pm^′)(ac2^′) {-6} at^′`hierarchy`nodes(ac2^′) {-7} roots(at^′`hierarchy)(ac2^′) {-8} plain_memory?(pm^′) {-9} allocator?(pm^′)(ac^′) {-10} at^′`hierarchy`nodes(ac^′) {-11} size^′ > 0 {-12} pm^′`states(s^′) {-13} allocation_ok?(pm^′)(at^′, s^′) {-14} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac1^′ = ac^′ {2} ac1^′ = ac2^′ {3} disjoint?(ac1^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{4} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Case splitting on ac2!1 = ac!1,

we get 2 subgoals:

546

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        allocation_alloc.3.2.1:

{-1} ac2^′ = ac^′

{-2} disjoint?(ac1^′`memory_pool(pm^′)(s^′), ac2^′`memory_pool(pm^′)(s^′))

{-3} allocator?(pm^′)(ac1^′) {-4} at^′`hierarchy`nodes(ac1^′) {-5} roots(at^′`hierarchy)(ac1^′) {-6} allocator?(pm^′)(ac2^′) {-7} at^′`hierarchy`nodes(ac2^′) {-8} roots(at^′`hierarchy)(ac2^′) {-9} plain_memory?(pm^′) {-10} allocator?(pm^′)(ac^′) {-11} at^′`hierarchy`nodes(ac^′) {-12} size^′ > 0 {-13} pm^′`states(s^′) {-14} allocation_ok?(pm^′)(at^′, s^′) {-15} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac1^′ = ac^′ {2} ac1^′ = ac2^′ {3} disjoint?(ac1^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{4} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Replacing using formula -1,

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.3.2.1.

                                                                                                                        allocation_alloc.3.2.2:

{-1} disjoint?(ac1^′`memory_pool(pm^′)(s^′), ac2^′`memory_pool(pm^′)(s^′))

{-2} allocator?(pm^′)(ac1^′) {-3} at^′`hierarchy`nodes(ac1^′) {-4} roots(at^′`hierarchy)(ac1^′) {-5} allocator?(pm^′)(ac2^′) {-6} at^′`hierarchy`nodes(ac2^′) {-7} roots(at^′`hierarchy)(ac2^′) {-8} plain_memory?(pm^′) {-9} allocator?(pm^′)(ac^′) {-10} at^′`hierarchy`nodes(ac^′) {-11} size^′ > 0 {-12} pm^′`states(s^′) {-13} allocation_ok?(pm^′)(at^′, s^′) {-14} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac2^′ = ac^′ {2} ac1^′ = ac^′ {3} ac1^′ = ac2^′ {4} disjoint?(ac1^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))),

ac2^′`memory_pool(pm^′)(state(ac^′`alloc(pm^′)(size^′)(s^′))))

{5} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Using lemma allocation_alloc_other_private_memory, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures,

547 C Proof scripts

Using lemma allocator_const_private_memory_memory_pool,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_alloc.3.2.2.

                                                                                                                        allocation_alloc.4:

{-1} plain_memory?(pm^′) {-2} allocator?(pm^′)(ac^′) {-3} at^′`hierarchy`nodes(ac^′) {-4} size^′ > 0 {-5} pm^′`states(s^′) {-6} allocation_ok?(pm^′)(at^′, s^′) {-7} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ∀ (ac1, ac2: (at^′`hierarchy`nodes)):

ac1 = ac2 ∨ disjoint?(ac1`private_mem(pm^′), ac2`private_mem(pm^′)) {2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Repeatedly Skolemizing and flattening,

Using lemma allocation_private_memory_disjoint,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_alloc.4.

                                                                                                                        allocation_alloc.5:

{-1} plain_memory?(pm^′) {-2} allocator?(pm^′)(ac^′) {-3} at^′`hierarchy`nodes(ac^′) {-4} size^′ > 0 {-5} pm^′`states(s^′) {-6} allocation_ok?(pm^′)(at^′, s^′) {-7} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ∀ (ac: (at^′`hierarchy`nodes)):

consistent_allocator?(pm^′)

(ac,

at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)),

size^′), at^′`info(ac^′))]

(ac)) (state(ac^′`alloc(pm^′)(size^′)(s^′)))

{2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Repeatedly Skolemizing and flattening,

Using lemma allocation_consistent_allocator,

Simplifying, rewriting, and recording with decision procedures,

Case splitting on ac!1 = ac!2,

we get 2 subgoals:

548

C.9 Proofs for Allocation_Table (allocators.pvs)

                                                                                                                        allocation_alloc.5.1:

{-1} ac^′ = ac^{′′}

{-2} consistent_allocator?(pm^′)(ac^{′′}, at^′`info(ac^{′′}))(s^′)

{-3} allocator?(pm^′)(ac^{′′}) {-4} at^′`hierarchy`nodes(ac^{′′}) {-5} plain_memory?(pm^′) {-6} allocator?(pm^′)(ac^′) {-7} at^′`hierarchy`nodes(ac^′) {-8} size^′ > 0 {-9} pm^′`states(s^′) {-10} allocation_ok?(pm^′)(at^′, s^′) {-11} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} consistent_allocator?(pm^′)

(ac^{′′},

at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac^{′′})) (state(ac^′`alloc(pm^′)(size^′)(s^′)))

{2} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Replacing using formula -1,

Simplifying, rewriting, and recording with decision procedures, Rewriting using consistent_allocator_alloc, matching in *, This completes the proof of allocation_alloc.5.1.

                                                                                                                        allocation_alloc.5.2:

{-1} consistent_allocator?(pm^′)(ac^{′′}, at^′`info(ac^{′′}))(s^′)

{-2} allocator?(pm^′)(ac^{′′}) {-3} at^′`hierarchy`nodes(ac^{′′}) {-4} plain_memory?(pm^′) {-5} allocator?(pm^′)(ac^′) {-6} at^′`hierarchy`nodes(ac^′) {-7} size^′ > 0 {-8} pm^′`states(s^′) {-9} allocation_ok?(pm^′)(at^′, s^′) {-10} OK?(ac^′`alloc(pm^′)(size^′)(s^′)) {1} ac^′ = ac^{′′} {2} consistent_allocator?(pm^′)

(ac^{′′},

at^′`info

with [(ac^′)

:= cons((data(ac^′`alloc(pm^′)(size^′)(s^′)), size^′),

at^′`info(ac^′))]

(ac^{′′})) (state(ac^′`alloc(pm^′)(size^′)(s^′)))

{3} data(ac^′`alloc(pm^′)(size^′)(s^′)) = null_address

Simplifying, rewriting, and recording with decision procedures,

Using lemma consistent_allocator_state_change,

Simplifying, rewriting, and recording with decision procedures,

Using lemma allocation_alloc_other_private_memory,

Simplifying, rewriting, and recording with decision procedures,

549 C Proof scripts

Using lemma allocator_const_private_memory_allocated, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.5.2. Q.E.D.

C.10 Proofs for Allocator (allocators.pvs)

C.10.1 Allocator.null_address_TCC1

                                                                                                                        Terse proof for null_address_TCC1.
                                                                                                                        null_address_TCC1:

{1} Mem?(Mem(0)`type_of)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of null_address_TCC1.

Q.E.D.

C.10.2 Allocator.allocator?_TCC1

                                                                                                                        Terse proof for allocator?_TCC1.
                                                                                                                        allocator?_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size: posnat):

disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of allocator?_TCC1.

Q.E.D.

C.10.3 Allocator.allocator?_TCC2

                                                                                                                        Terse proof for allocator?_TCC2.

550

C.10 Proofs for Allocator (allocators.pvs)

                                                                                                                        allocator?_TCC2:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (addr1: Address):

OK?(ac`free(pm)(addr1)(s)) ⊃ OK?[State, Unit](ac`free(pm)(addr1)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr1)(s))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of allocator?_TCC2.

Q.E.D.

C.10.4 Allocator.allocator?_TCC3

                                                                                                                        Terse proof for allocator?_TCC3.

551 C Proof scripts

                                                                                                                        allocator?_TCC3:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s)

⊃

(∀ (addr1: Address): OK?(ac`free(pm)(addr1)(s)) ⊃ up?[posnat](ac`freed_size(pm)(addr1)(s))))

Repeatedly Skolemizing and flattening,

Rewriting using -3, matching in *,

This completes the proof of allocator?_TCC3.

Q.E.D.

C.10.5 Allocator.allocator?_TCC4

                                                                                                                        Terse proof for allocator?_TCC4.

552

C.10 Proofs for Allocator (allocators.pvs)

                                                                                                                        allocator?_TCC4:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (s_2: State): pm`states(s_2) ∧ stays_unchanged(pm)(s, s_2, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_2) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_2))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size1: posnat):

has_next_state(ac`alloc(pm)(size1)(s)) ⊃

OK?[State, Address](ac`alloc(pm)(size1)(s)) ∨

Exception?[State, Address](ac`alloc(pm)(size1)(s))))

Repeatedly Skolemizing and flattening,

Expanding the definition of has_next_state,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of allocator?_TCC4. Q.E.D.

C.10.6 Allocator.allocator?_TCC5

                                                                                                                        Terse proof for allocator?_TCC5.

553 C Proof scripts

                                                                                                                        allocator?_TCC5:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (size: posnat): has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧

(∀ (s_2: State):

pm`states(s_2) ∧ stays_unchanged(pm)(s, s_2, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_2) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_2))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (addr1: Address):

has_next_state(ac`free(pm)(addr1)(s)) ⊃ OK?[State, Unit](ac`free(pm)(addr1)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr1)(s))))

Repeatedly Skolemizing and flattening,

Expanding the definition of has_next_state,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocator?_TCC5.

Q.E.D.

554

C.10 Proofs for Allocator (allocators.pvs)

C.10.7 Allocator.allocator?_TCC6

                                                                                                                        Terse proof for allocator?_TCC6.
                                                                                                                        allocator?_TCC6:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

(∀ (s: State):

(∀ (addr: Address): has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s))))

∧

(∀ (size: posnat): has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧

(∀ (s_2: State): pm`states(s_2) ∧ stays_unchanged(pm)(s, s_2, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_2) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_2))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size1: posnat):

OK?(ac`alloc(pm)(size1)(s)) ∧

¬ data(ac`alloc(pm)(size1)(s)) = null_address

⊃

OK?[State, Address](ac`alloc(pm)(size1)(s)) ∨

Exception?[State, Address](ac`alloc(pm)(size1)(s))))

555 C Proof scripts

Repeatedly Skolemizing and flattening,

This completes the proof of allocator?_TCC6.

Q.E.D.

C.10.8 Allocator.allocator?_TCC7

                                                                                                                        Terse proof for allocator?_TCC7.

556

C.10 Proofs for Allocator (allocators.pvs)

                                                                                                                        allocator?_TCC7:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

(∀ (s: State):

(∀ (addr: Address): has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s))))

∧

(∀ (size: posnat): has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧

(∀ (s_2: State): pm`states(s_2) ∧ stays_unchanged(pm)(s, s_2, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_2) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_2))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size1: posnat):

OK?(ac`alloc(pm)(size1)(s)) ∧

¬ data(ac`alloc(pm)(size1)(s)) = null_address

⊃ pm`states(state[State, Address](ac`alloc(pm)(size1)(s)))))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of has_next_state,

Simplifying, rewriting, and recording with decision procedures,

557 C Proof scripts

This completes the proof of allocator?_TCC7.

Q.E.D.

C.10.9 Allocator.allocator?_TCC8

                                                                                                                        Terse proof for allocator?_TCC8.

558

C.10 Proofs for Allocator (allocators.pvs)

                                                                                                                        allocator?_TCC8:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

(∀ (s: State):

(∀ (size: posnat): OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ only_changes(pm)(s, state(ac`alloc(pm)(size)(s)), ac`private_mem(pm)))

∧

(∀ (addr: Address):

has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s))))

∧

(∀ (size: posnat): has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧

(∀ (s_2: State): pm`states(s_2) ∧ stays_unchanged(pm)(s, s_2, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_2) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_2))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ⊃

ac`allocated(pm)(state(ac`free(pm)(addr)(s))) =

(ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (free_addr: Address):

OK?(ac`free(pm)(free_addr)(s)) ⊃

pm`states(state[State, Unit](ac`free(pm)(free_addr)(s)))))

559 C Proof scripts

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of has_next_state,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator?_TCC8.

Q.E.D.

C.10.10 Allocator.allocator_subset_private_memory_plain_memory

                                                                                                                        Terse proof for allocator_subset_private_memory_plain_memory.
                                                                                                                        allocator_subset_private_memory_plain_memory:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm))):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocator_subset_private_memory_plain_memory.

Q.E.D.

C.10.11 Allocator.allocator_private_memory_in_plain_memory

                                                                                                                        Terse proof for allocator_private_memory_in_plain_memory.
                                                                                                                        allocator_private_memory_in_plain_memory:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address): ac`private_mem(pm)(addr) ⊃ union(pm`ro_addr, pm`rw_addr)(addr)

Repeatedly Skolemizing and flattening,

Using lemma allocator_subset_private_memory_plain_memory,

Using lemma subset_member,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocator_private_memory_in_plain_memory.

Q.E.D.

C.10.12 Allocator.allocator_subset_allocated_memory_pool

                                                                                                                        Terse proof for allocator_subset_allocated_memory_pool.
                                                                                                                        allocator_subset_allocated_memory_pool:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), s: State):

pm`states(s) ⊃ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of allocator_subset_allocated_memory_pool.

Q.E.D.

560

C.10 Proofs for Allocator (allocators.pvs)

C.10.13 Allocator.allocator_alloc_disjoint

Terse proof for allocator_alloc_disjoint.
allocator_alloc_disjoint:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s^′, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_alloc_disjoint.

Q.E.D.

C.10.14 Allocator.allocator_allocated_alloc_TCC1

Terse proof for allocator_allocated_alloc_TCC1.
allocator_allocated_alloc_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of allocator_allocated_alloc_TCC1.

Q.E.D.

C.10.15 Allocator.allocator_allocated_alloc

Terse proof for allocator_allocated_alloc.
allocator_allocated_alloc:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

cv_base_not_const.1:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(typ(typ′))
{-4} const?(cv_base(typ(typ(typ′))))

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of const_stutter?,

which is trivially true.

This completes the proof of cv_base_not_const.1.

861 C Proof scripts

cv_base_not_const.2:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ(typ′))

Expanding the definition of cv_base,

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of subterm,

Expanding the definition of volatile_stutter?,

Expanding the definition of const_volatile?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_not_const.2.

862

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

                                                                                                cv_base_not_const.3:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ(typ′))
{-3} const?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ′)

Instantiating quantified variables,

Expanding the definition of const_volatile?,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of cv_base_not_const.3.

863 C Proof scripts

                                                                                                                        cv_base_not_const.4:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(cv_base(typ(typ(typ′))))
{-3} volatile?(typ(typ′))
{-4} volatile?(typ′)

Instantiating quantified variables,

Expanding the definition of volatile_stutter?,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of cv_base_not_const.4.

Q.E.D.

C.40.27 Cpp_Deep_Type_Wellformedness.cv_base_not_volatile

                                                                                                                        Terse proof for cv_base_not_volatile.
                                                                                                                        cv_base_not_volatile:

{1} ∀ (typ: Cpp_Type): ¬ volatile?(cv_base(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of cv_base, Expanding the definition of cv_base,

864

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

Expanding the definition of Cpp_Type?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

                                                                                                                        cv_base_not_volatile.1:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(typ(typ′))
{-4} volatile?(cv_base(typ(typ(typ′))))

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of const_stutter?,

which is trivially true.

This completes the proof of cv_base_not_volatile.1.

865 C Proof scripts

                                                                                                                        cv_base_not_volatile.2:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} volatile?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ(typ′))

Expanding the definition of cv_base,

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of subterm,

Expanding the definition of volatile_stutter?,

Expanding the definition of const_volatile?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_not_volatile.2.

866

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

                                                                                                                        cv_base_not_volatile.3:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ(typ′))
{-3} volatile?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ′)

Instantiating quantified variables,

Expanding the definition of const_volatile?,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of cv_base_not_volatile.3.

867 C Proof scripts

                                                                                                                        cv_base_not_volatile.4:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃

no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} volatile?(cv_base(typ(typ(typ′))))
{-3} volatile?(typ(typ′))
{-4} volatile?(typ′)

Instantiating quantified variables,

Expanding the definition of volatile_stutter?,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of cv_base_not_volatile.4.

Q.E.D.

C.40.28 Cpp_Deep_Type_Wellformedness.cv_base_cv

Terse proof for cv_base_cv.

                                                                                                                        cv_base_cv:

{1} ∀ (P: PRED[Cpp_Type_], typ: Cpp_Type):

(P ⊆ interpreted?) ⊃ (P (cv_base(typ)) ≡ cv(P)(typ))

Repeatedly Skolemizing and flattening, Applying propositional simplification,

868

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

we get 2 subgoals:

                                                                                                                        cv_base_cv.1:

{-1} P′(cv_base(typ′))
{-2} Cpp_Type?(typ′)
{-3} (P′ ⊆ interpreted?)
{1} cv(P′)(typ′)

Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Applying disjunctive simplification to flatten sequent, Expanding the definition of cv_base, Installing automatic rewrites from: subterm const_stutter? volatile_stutter? const_volatile? Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

                                                                                                                        cv_base_cv.1.1:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ′)))
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} P′(typ(typ(typ′)))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        cv_base_cv.1.1.1:

{-1} const?(typ′)
{-2} const?(typ(typ′))
{-3} P′(cv_base(typ(typ(typ′))))
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.1.1.

                                                                                                                        cv_base_cv.1.1.2:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ(typ′))))
{-3} volatile?(typ(typ′))
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of cv_base,

869 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        cv_base_cv.1.1.2.1:

{-1} const?(typ′)
{-2} const?(typ(typ(typ′)))
{-3} P′(cv_base(typ(typ(typ(typ′)))))
{-4} volatile?(typ(typ′))
{-5} Cpp_Type?(typ′)
{-6} (P′ ⊆ interpreted?)
{1} P′(typ(typ(typ′)))
{2} P′(typ(typ′))
{3} P′(typ′)

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.1.2.1.

                                                                                                                        cv_base_cv.1.1.2.2:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ(typ(typ′)))))
{-3} volatile?(typ(typ(typ′)))
{-4} volatile?(typ(typ′))
{-5} Cpp_Type?(typ′)
{-6} (P′ ⊆ interpreted?)
{1} P′(typ(typ(typ′)))
{2} P′(typ(typ′))
{3} P′(typ′)

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.1.2.2.

                                                                                                                        cv_base_cv.1.2:

{-1} P′(cv_base(typ(typ′)))
{-2} volatile?(typ′)
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} P′(typ(typ(typ′)))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

870

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

                                                                                                                        cv_base_cv.1.2.1:

{-1} const?(typ(typ′))
{-2} P′(cv_base(typ(typ(typ′))))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.2.1.

                                                                                                                        cv_base_cv.1.2.2:

{-1} P′(cv_base(typ(typ(typ′))))
{-2} volatile?(typ(typ′))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.2.2.

                                                                                                                        cv_base_cv.1.3:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ′)))
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} volatile?(typ(typ′))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.3.

                                                                                                                        cv_base_cv.1.4:

{-1} P′(cv_base(typ(typ′)))
{-2} volatile?(typ′)
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} volatile?(typ(typ′))

871 C Proof scripts

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.4.

                                                                                                                        cv_base_cv.1.5:

{-1} P′(cv_base(typ(typ′)))
{-2} volatile?(typ′)
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        cv_base_cv.1.5.1:

{-1} const?(typ(typ′))
{-2} P′(cv_base(typ(typ(typ′))))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.5.1.

                                                                                                                        cv_base_cv.1.5.2:

{-1} P′(cv_base(typ(typ(typ′))))
{-2} volatile?(typ(typ′))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)

Expanding the definition of Cpp_Type?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_cv.1.5.2.

                                                                                                                        cv_base_cv.2:

{-1} cv(P′)(typ′)
{-2} Cpp_Type?(typ′)
{-3} (P′ ⊆ interpreted?)
{1} P′(cv_base(typ′))

Rewriting using cv_base_result, matching in * where P gets P!1,

This completes the proof of cv_base_cv.2.

Q.E.D.

872

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

C.40.29 Cpp_Deep_Type_Wellformedness.layout_compatible?_TCC1

                                                                                                                        Terse proof for layout_compatible?_TCC1.
                                                                                                                        layout_compatible?_TCC1:

{1} ∃ (x: equivalence[Cpp_Type]): true

Instantiating the top quantifier in 1 with the terms: (=),

we get 2 subgoals:

                                                                                                                        layout_compatible?_TCC1.1:

{1} true

which is trivially true.

                                                                                                                        This completes the proof of layout_compatible?_TCC1.1.
                                                                                                                        layout_compatible?_TCC1.2:

{1} equivalence?[Cpp_Type] (restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](=))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of layout_compatible?_TCC1.2.

Q.E.D.

C.40.30

Cpp_Deep_Type_Wellformedness.layout_compatible_enums_TCC1

                                                                                                                        Terse proof for layout_compatible_enums_TCC1.
                                                                                                                        layout_compatible_enums_TCC1:

{1} ∀ (e_{1}, e_{2}: Cpp_Subtype(enum?)): array?(e_{1}) ∨ pointer?(e_{1}) ∨ reference?(e_{1}) ∨ bitfield?(e_{1}) ∨ enum?(e_{1}) ∨ pointer_to_member?(e_{1}) ∨ const?(e_{1}) ∨ volatile?(e_{1})

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of layout_compatible_enums_TCC1.

Q.E.D.

C.40.31

Cpp_Deep_Type_Wellformedness.layout_compatible_enums_TCC2

                                                                                                                        Terse proof for layout_compatible_enums_TCC2.
                                                                                                                        layout_compatible_enums_TCC2:

{1} ∀ (e_{1}, e_{2}: Cpp_Subtype(enum?)): array?(e_{2}) ∨ pointer?(e_{2}) ∨ reference?(e_{2}) ∨ bitfield?(e_{2}) ∨ enum?(e_{2}) ∨ pointer_to_member?(e_{2}) ∨ const?(e_{2}) ∨ volatile?(e_{2})

873 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of layout_compatible_enums_TCC2.

Q.E.D.

C.41 Proofs for Cpp_Deep_Types (types.pvs)

C.41.1 Cpp_Deep_Types.Cpp_Type__pointer_to_member_eta_TCC1

                                                                                                                        Terse proof for Cpp_Type__pointer_to_member_eta_TCC1.
                                                                                                                        Cpp_Type__pointer_to_member_eta_TCC1:

{1} ∀ (pointer_to_member?_var: (pointer_to_member?)):

array?(pointer_to_member?_var) ∨ pointer?(pointer_to_member?_var) ∨ reference?(pointer_to_member?_var) ∨ bitfield?(pointer_to_member?_var) ∨ enum?(pointer_to_member?_var) ∨ pointer_to_member?(pointer_to_member?_var) ∨ const?(pointer_to_member?_var) ∨ volatile?(pointer_to_member?_var)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of Cpp_Type__pointer_to_member_eta_TCC1.

Q.E.D.

C.41.2 Cpp_Deep_Types.Cpp_Type__pointer_to_member_eta_TCC2

                                                                                                                        Terse proof for Cpp_Type__pointer_to_member_eta_TCC2.
                                                                                                                        Cpp_Type__pointer_to_member_eta_TCC2:

{1} ∀ (pointer_to_member?_var: (pointer_to_member?)): class?(typ(pointer_to_member?_var))

Repeatedly Skolemizing and flattening,

Adding type constraints for typ(pointer_to_member?_var!1),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of Cpp_Type__pointer_to_member_eta_TCC2.

Q.E.D.

C.41.3 Cpp_Deep_Types.Cpp_Type__typ_pointer_to_member_TCC1

                                                                                                                        Terse proof for Cpp_Type__typ_pointer_to_member_TCC1.
                                                                                                                        Cpp_Type__typ_pointer_to_member_TCC1:

{1} ∀ (pointer_to_member1_var: (class?), pointer_to_member2_var: Cpp_Type_): array?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ pointer?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ reference?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ bitfield?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ enum?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ pointer_to_member?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ const?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ volatile?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var))

874

C.41 Proofs for Cpp_Deep_Types (types.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of Cpp_Type__typ_pointer_to_member_TCC1.

Q.E.D.

C.41.4 Cpp_Deep_Types.subterm_less

Terse proof for subterm_less.

                                                                                                                        subterm_less:

{1} ∀ (t_{1}, t_{2}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2}

Inducting on t_{2} on formula 1,

we get 28 subgoals:

                                                                                                                        subterm_less.1:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, uchar) ∧ t_{1} ≠ uchar ⊃ t_{1} ≪ uchar

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.1.

                                                                                                                        subterm_less.2:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, schar) ∧ t_{1} ≠ schar ⊃ t_{1} ≪ schar

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.2.

                                                                                                                        subterm_less.3:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, char) ∧ t_{1} ≠ char ⊃ t_{1} ≪ char

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.3.

                                                                                                                        subterm_less.4:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, short) ∧ t_{1} ≠ short ⊃ t_{1} ≪ short

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.4.

                                                                                                                        subterm_less.5:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, int) ∧ t_{1} ≠ int ⊃ t_{1} ≪ int

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.5.

                                                                                                                        subterm_less.6:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, long) ∧ t_{1} ≠ long ⊃ t_{1} ≪ long

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.6.

                                                                                                                        subterm_less.7:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, longlong) ∧ t_{1} ≠ longlong ⊃ t_{1} ≪ longlong

875 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.7.

                                                                                                                        subterm_less.8:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, ushort) ∧ t_{1} ≠ ushort ⊃ t_{1} ≪ ushort

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.8.

                                                                                                                        subterm_less.9:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, uint) ∧ t_{1} ≠ uint ⊃ t_{1} ≪ uint

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.9.

                                                                                                                        subterm_less.10:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, ulong) ∧ t_{1} ≠ ulong ⊃ t_{1} ≪ ulong

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.10.

                                                                                                                        subterm_less.11:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, ulonglong) ∧ t_{1} ≠ ulonglong ⊃ t_{1} ≪ ulonglong

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.11.

                                                                                                                        subterm_less.12:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, wchar_t) ∧ t_{1} ≠ wchar_t ⊃ t_{1} ≪ wchar_t

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.12.

                                                                                                                        subterm_less.13:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, bool) ∧ t_{1} ≠ bool ⊃ t_{1} ≪ bool

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.13.

                                                                                                                        subterm_less.14:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, float) ∧ t_{1} ≠ float ⊃ t_{1} ≪ float

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.14.

                                                                                                                        subterm_less.15:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, double) ∧ t_{1} ≠ double ⊃ t_{1} ≪ double

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.15.

876

C.41 Proofs for Cpp_Deep_Types (types.pvs)

                                                                                                                        subterm_less.16:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, longdouble) ∧ t_{1} ≠ longdouble ⊃ t_{1} ≪ longdouble

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.16.

                                                                                                                        subterm_less.17:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, void) ∧ t_{1} ≠ void ⊃ t_{1} ≪ void

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.17.

                                                                                                                        subterm_less.18:

{1} ∀ (array_type1_var: Cpp_Type_, array_type2_var: nat):

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, array_type1_var) ∧ t_{1} ≠ array_type1_var ⊃ t_{1} ≪ array_type1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, array_type(array_type1_var, array_type2_var)) ∧ t_{1} ≠ array_type(array_type1_var, array_type2_var) ⊃ t_{1} ≪ array_type(array_type1_var, array_type2_var))

Repeatedly Skolemizing and flattening,

Expanding the definition of «,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.18.

                                                                                                                        subterm_less.19:

{1} ∀ (function_type1_var: Cpp_Type_, function_type2_var: list[Cpp_Type_],

function_type3_var: bool): (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type1_var) ∧ t_{1} ≠ function_type1_var ⊃ t_{1} ≪ function_type1_var)

∧

every(λ (t_{2}: Cpp_Type_): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2})

(function_type2_var) ⊃

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type(function_type1_var, function_type2_var, function_type3_var))

∧ t_{1} ≠ function_type(function_type1_var, function_type2_var, func-

tion_type3_var)

⊃ t_{1} ≪ function_type(function_type1_var, function_type2_var, func-

tion_type3_var))

Repeatedly Skolemizing and flattening,

Expanding the definition of «,

Expanding the definition of subterm,

877 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        subterm_less.19.1:

{-1} ∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type1_var′) ∧ t_{1} ≠ function_type1_var′ ⊃ t_{1} ≪ function_type1_var′

{-2} every(λ (t_{2}: Cpp_Type_): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2})

(function_type2_var′)

{-3} subterm(t′_{1}, function_type1_var′)
{1} t′_{1} = function_type(function_type1_var′, function_type2_var′, function_type3_var′)
{2} t′_{1} = function_type1_var′
{3} t′_{1} ≪ function_type1_var′
{4} some[Cpp_Type_](λ (z: Cpp_Type_): t′_{1} = z ∨ t′_{1} ≪ z)(function_type2_var′)

Instantiating the top quantifier in -1 with the terms: (t1!1),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of subterm_less.19.1.

                                                                                                                        subterm_less.19.2:

{-1} ∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type1_var′) ∧ t_{1} ≠ function_type1_var′ ⊃ t_{1} ≪ function_type1_var′

{-2} every(λ (t_{2}: Cpp_Type_): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2})

(function_type2_var′)

{-3} some[Cpp_Type_](λ (z: Cpp_Type_): subterm(t′_{1}, z))(function_type2_var′)
{1} t′_{1} = function_type(function_type1_var′, function_type2_var′, function_type3_var′)
{2} t′_{1} = function_type1_var′
{3} t′_{1} ≪ function_type1_var′
{4} some[Cpp_Type_](λ (z: Cpp_Type_): t′_{1} = z ∨ t′_{1} ≪ z)(function_type2_var′)

Rewriting using some_iff_exists, matching in *, Rewriting using some_iff_exists, matching in *, Rewriting using every_iff_forall, matching in *, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 4 with the terms: (t!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -2 with the terms: (t!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.19.2.

                                                                                                                        subterm_less.20:

{1} ∀ (pointer1_var: Cpp_Type_):

(∀ (t_{1}: Cpp_Type_): subterm(t_{1}, pointer1_var) ∧ t_{1} ≠ pointer1_var ⊃ t_{1} ≪ pointer1_var)

⊃
(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer(pointer1_var)) ∧ t_{1} ≠ pointer(pointer1_var) ⊃ t_{1} ≪ pointer(pointer1_var))

Repeatedly Skolemizing and flattening,

Expanding the definition of «,

Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.20.

878

C.41 Proofs for Cpp_Deep_Types (types.pvs)

                                                                                                                        subterm_less.21:

{1} ∀ (reference1_var: Cpp_Type_): (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, reference1_var) ∧ t_{1} ≠ reference1_var ⊃ t_{1} ≪ reference1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, reference(reference1_var)) ∧ t_{1} ≠ reference(reference1_var) ⊃ t_{1} ≪ reference(reference1_var))

Repeatedly Skolemizing and flattening,

Expanding the definition of «,

Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.21.

                                                                                                                        subterm_less.22:

{1} ∀ (class1_var: string, class2_var: bool): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, class(class1_var, class2_var)) ∧ t_{1} ≠ class(class1_var, class2_var) ⊃ t_{1} ≪ class(class1_var, class2_var)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.22.

                                                                                                                        subterm_less.23:

{1} ∀ (union1_var: string):

∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, union(union1_var)) ∧ t_{1} ≠ union(union1_var) ⊃ t_{1} ≪ union(union1_var)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subterm_less.23.

                                                                                                                        subterm_less.24:

{1} ∀ (bitfield1_var: Cpp_Type_, bitfield2_var: nat, bitfield3_var: posnat):

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, bitfield1_var) ∧ t_{1} ≠ bitfield1_var ⊃ t_{1} ≪ bitfield1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, bitfield(bitfield1_var, bitfield2_var, bitfield3_var)) ∧ t_{1} ≠ bitfield(bitfield1_var, bitfield2_var, bitfield3_var) ⊃ t_{1} ≪ bitfield(bitfield1_var, bitfield2_var, bitfield3_var))

Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of «, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.24.

879 C Proof scripts

                                                                                                                        subterm_less.25:

{1} ∀ (enum1_var: string, enum2_var: Cpp_Type_, enum3_var: posnat,

enum4_var: [below[enum3_var] → int]): (∀ (t_{1}: Cpp_Type_): subterm(t_{1}, enum2_var) ∧ t_{1} ≠ enum2_var ⊃ t_{1} ≪ enum2_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, enum(enum1_var, enum2_var, enum3_var, enum4_var)) ∧

t_{1} ≠ enum(enum1_var, enum2_var, enum3_var, enum4_var) ⊃ t_{1} ≪ enum(enum1_var, enum2_var, enum3_var, enum4_var))

Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of «, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.25.

                                                                                                                        subterm_less.26:

{1} ∀ (pointer_to_member1_var: (class?), pointer_to_member2_var: Cpp_Type_):

((∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer_to_member1_var) ∧ t_{1} ≠ pointer_to_member1_var ⊃ t_{1} ≪ pointer_to_member1_var)

∧

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer_to_member2_var) ∧ t_{1} ≠ pointer_to_member2_var ⊃ t_{1} ≪ pointer_to_member2_var))

⊃

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∧ t_{1} ≠ pointer_to_member(pointer_to_member1_var, pointer_to_member2_var) ⊃ t_{1} ≪ pointer_to_member(pointer_to_member1_var, pointer_to_member2_var))

Repeatedly Skolemizing and flattening,

Expanding the definition of «,

Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -2 with the terms: (t1!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.26.

                                                                                                                        subterm_less.27:

{1} ∀ (const1_var: Cpp_Type_):

(∀ (t_{1}: Cpp_Type_): subterm(t_{1}, const1_var) ∧ t_{1} ≠ const1_var ⊃ t_{1} ≪ const1_var) ⊃

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, const(const1_var)) ∧ t_{1} ≠ const(const1_var) ⊃

t_{1} ≪ const(const1_var))

Repeatedly Skolemizing and flattening,

Expanding the definition of «,

Expanding the definition of subterm, Instantiating quantified variables,

880

C.41 Proofs for Cpp_Deep_Types (types.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.27.

subterm_less.28:

{1} ∀ (volatile1_var: Cpp_Type_):

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, volatile1_var) ∧ t_{1} ≠ volatile1_var ⊃ t_{1} ≪ volatile1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, volatile(volatile1_var)) ∧ t_{1} ≠ volatile(volatile1_var) ⊃ t_{1} ≪ volatile(volatile1_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.28. Q.E.D.

C.41.5 Cpp_Deep_Types.subterm_transitive

Terse proof for subterm_transitive.
subterm_transitive:

{1} ∀ (t_{1}, t_{2}, t_{3}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ subterm(t_{2}, t_{3}) ⊃ subterm(t_{1}, t_{3})

Using lemma wf_induction[Cpp_Type_, ≪], For the top quantifier in 1, we introduce Skolem constants: (t1!1 t2!1 _), Instantiating the top quantifier in -1 with the terms: (LAMBDA (t3: Cpp_Type_): subterm(t1!1,

t2!1) AND subterm(t2!1, t3) IMPLIES subterm(t1!1, t3)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Splitting conjunctions, we get 3 subgoals:

subterm_transitive.1:

{-1} t′_{2} = x′

{-2} ∀ (y: Cpp_Type_):

y ≪ x′ ⊃ subterm(t′_{1}, t′_{2}) ∧ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)

{-3} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of subterm_transitive.1.

subterm_transitive.2:

{-1} ∀ (y: Cpp_Type_):

y ≪ x′ ⊃ subterm(t′_{1}, t′_{2}) ∧ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)

{-2} subterm(t′_{1}, t′_{2})
{1} true
{2} subterm(t′_{1}, x′)

881 C Proof scripts

which is trivially true. This completes the proof of subterm_transitive.2.

subterm_transitive.3:

{-1} ¬ uchar?(x′) ∧

if schar?(x′) then false elsif char?(x′) then false elsif short?(x′) then false elsif int?(x′) then false elsif long?(x′) then false elsif longlong?(x′) then false elsif ushort?(x′) then false elsif uint?(x′) then false elsif ulong?(x′) then false elsif ulonglong?(x′) then false elsif wchar_t?(x′) then false elsif bool?(x′) then false elsif float?(x′) then false elsif double?(x′) then false elsif longdouble?(x′) then false elsif void?(x′) then false elsif array?(x′) then subterm(t′_{2}, typ(x′)) elsif function?(x′)

then subterm(t′_{2}, ret_typ(x′)) ∨

some[Cpp_Type_](λ (z: Cpp_Type_): subterm(t′_{2}, z))(args_typ(x′))

elsif pointer?(x′) then subterm(t′_{2}, typ(x′)) elsif reference?(x′) then subterm(t′_{2}, typ(x′)) elsif class?(x′) then false elsif union?(x′) then false elsif bitfield?(x′) then subterm(t′_{2}, typ(x′)) elsif enum?(x′) then subterm(t′_{2}, typ(x′)) elsif pointer_to_member?(x′)

then subterm(t′_{2}, typ(x′)) ∨ subterm(t′_{2}, member_typ(x′)) elsif const?(x′) then subterm(t′_{2}, typ(x′)) else subterm(t′_{2}, typ(x′))

{-2} ∀ (y: Cpp_Type_):

y ≪ x′ ⊃ subterm(t′_{1}, t′_{2}) ∧ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)

{-3} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 7 subgoals:

subterm_transitive.3.1:

{-1} array?(x′)
{-2} subterm(t′_{2}, typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (typ(x!1)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

882

C.41 Proofs for Cpp_Deep_Types (types.pvs)

                                                                                                subterm_transitive.3.1.1:

{-1} array?(x′)
{-2} subterm(t′_{2}, typ(x′))
{-3} subterm(t′_{1}, typ(x′))
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Expanding the definition of subterm,

which is trivially true.

                                                                                                This completes the proof of subterm_transitive.3.1.1.
                                                                                                subterm_transitive.3.1.2:

{-1} array?(x′)
{-2} subterm(t′_{2}, typ(x′))
{-3} subterm(t′_{1}, t′_{2})
{1} typ(x′) ≪ x′
{2} subterm(t′_{1}, x′)

Expanding the definition of «,

which is trivially true.

                                                                                                This completes the proof of subterm_transitive.3.1.2.
                                                                                                subterm_transitive.3.2:

{-1} function?(x′)
{-2} subterm(t′_{2}, ret_typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (ret_typ(x!1)),

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.2.

                                                                                                subterm_transitive.3.3:

{-1} function?(x′)
{-2} some[Cpp_Type_](λ (z: Cpp_Type_): subterm(t′_{2}, z))(args_typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Expanding the definition of subterm,

Applying disjunctive simplification to flatten sequent, Rewriting using some_iff_exists, matching in *, Rewriting using some_iff_exists, matching in *, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of «, Applying disjunctive simplification to flatten sequent, Rewriting using some_iff_exists, matching in *, Using lemma forall_not[Cpp_Type_], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -1 with the terms: (x!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

883 C Proof scripts

we get 2 subgoals:

                                                                                                                        subterm_transitive.3.3.1:

{-1} function?(x′)
{-2} member(t′, args_typ(x′))
{-3} subterm(t′_{2}, t′)
{-4} subterm(t′_{1}, t′_{2})
{1} t′ = x′
{2} t′ ≪ x′
{3} ∃ (t: Cpp_Type_): member(t, args_typ(x′)) ∧ (t′ = t ∨ t′ ≪ t)
{4} t′ = ret_typ(x′)
{5} t′ ≪ ret_typ(x′)
{6} subterm(t′_{1}, t′)
{7} t′_{1} = x′
{8} subterm(t′_{1}, ret_typ(x′))

Using lemma subterm_less,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Instantiating quantified variables,

                                                                                                                        This completes the proof of subterm_transitive.3.3.1.
                                                                                                                        subterm_transitive.3.3.2:

{-1} function?(x′)
{-2} member(t′, args_typ(x′))
{-3} subterm(t′_{2}, t′)
{-4} subterm(t′_{1}, t′_{2})
{1} member(x′, args_typ(x′))
{2} ∃ (t: Cpp_Type_): member(t, args_typ(x′)) ∧ (t′ = t ∨ t′ ≪ t)
{3} t′ = ret_typ(x′)
{4} t′ ≪ ret_typ(x′)
{5} subterm(t′_{1}, t′)
{6} t′_{1} = x′
{7} subterm(t′_{1}, ret_typ(x′))

Instantiating the top quantifier in 2 with the terms: (t!1),

which is trivially true.

                                                                                                                        This completes the proof of subterm_transitive.3.3.2.
                                                                                                                        subterm_transitive.3.4:

{-1} subterm(t′_{2}, typ(x′))
{-2} pointer?(x′)
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (typ(x!1)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.4.

                                                                                                                        subterm_transitive.3.5:

{-1} subterm(t′_{2}, typ(x′))
{-2} reference?(x′)
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

884

C.41 Proofs for Cpp_Deep_Types (types.pvs)

Instantiating the top quantifier in -3 with the terms: (typ(x!1)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.5.

                                                                                                                        subterm_transitive.3.6:

{-1} subterm(t′_{2}, typ(x′))
{-2} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-3} subterm(t′_{1}, t′_{2})
{1} uchar?(x′)
{2} schar?(x′)
{3} char?(x′)
{4} short?(x′)
{5} int?(x′)
{6} long?(x′)
{7} longlong?(x′)
{8} ushort?(x′)
{9} uint?(x′)
{10} ulong?(x′)
{11} ulonglong?(x′)
{12} wchar_t?(x′)
{13} bool?(x′)
{14} float?(x′)
{15} double?(x′)
{16} longdouble?(x′)
{17} void?(x′)
{18} function?(x′)
{19} class?(x′)
{20} union?(x′)
{21} subterm(t′_{1}, x′)

Instantiating the top quantifier in -2 with the terms: (typ(x!1)),

Expanding the definition of «,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of subterm,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of subterm_transitive.3.6.

                                                                                                                        subterm_transitive.3.7:

{-1} pointer_to_member?(x′)
{-2} subterm(t′_{2}, member_typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (member_typ(x!1)),

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.7. Q.E.D.

C.41.6 Cpp_Deep_Types.c_TCC1

Terse proof for c_TCC1.

885 C Proof scripts

                                                                                                                        c_TCC1:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_):

const?(typ) ∧ ¬ p(typ) ⊃

array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of c_TCC1.

Q.E.D.

C.41.7 Cpp_Deep_Types.v_TCC1

Terse proof for v_TCC1.

                                                                                                                        v_TCC1:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_):

volatile?(typ) ∧ ¬ p(typ) ⊃

array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of v_TCC1.

Q.E.D.

C.41.8 Cpp_Deep_Types.cv_TCC1

Terse proof for cv_TCC1.

                                                                                                                        cv_TCC1:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_):

const?(typ) ∧ ¬ v(p)(typ) ∧ ¬ c(p)(typ) ⊃ array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cv_TCC1.

Q.E.D.

C.41.9 Cpp_Deep_Types.cv_TCC2

Terse proof for cv_TCC2.

886

C.41 Proofs for Cpp_Deep_Types (types.pvs)

                                                                                                                        cv_TCC2:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_):

volatile?(typ(typ)) ∧ const?(typ) ∧ ¬ v(p)(typ) ∧ ¬ c(p)(typ) ⊃ array?(typ(typ)) ∨ pointer?(typ(typ)) ∨ reference?(typ(typ)) ∨ bitfield?(typ(typ)) ∨ enum?(typ(typ)) ∨ pointer_to_member?(typ(typ)) ∨ const?(typ(typ)) ∨ volatile?(typ(typ))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cv_TCC2.

Q.E.D.

C.41.10 Cpp_Deep_Types.cv_implied

Terse proof for cv_implied.

                                                                                                                        cv_implied:

{1} ∀ (p_{1}, p_{2}: PRED[Cpp_Type_], typ: Cpp_Type_):
(p_{1} ⊆ p_{2}) ∧ cv(p_{1})(typ) ⊃ cv(p_{2})(typ)

Repeatedly Skolemizing and flattening, Expanding the definition of subset?, Expanding the definition of member, Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Applying disjunctive simplification to flatten sequent, Splitting conjunctions, we get 5 subgoals:

                                                                                                                        cv_implied.1:

{-1} p′_{1}(typ′)
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_implied.1.

                                                                                                                        cv_implied.2:

{-1} (const?(typ′) ∧ p′_{1}(typ(typ′)))
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

887 C Proof scripts

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_implied.2.

                                                                                                                        cv_implied.3:

{-1} p′_{1}(typ′)
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_implied.3.

                                                                                                                        cv_implied.4:

{-1} (volatile?(typ′) ∧ p′_{1}(typ(typ′)))
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_implied.4.

                                                                                                                        cv_implied.5:

{-1} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{1}(typ(typ(typ′))))
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_implied.5.

Q.E.D.

C.41.11 Cpp_Deep_Types.pod?_TCC1

Terse proof for pod?_TCC1.

888

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

                                                                                                                        pod?_TCC1:

{1} ∀ (t: Cpp_Type_):

array?(t) ∧

¬ (class?(t) ∧ (pod_struct?(t) ∨ pod_union?(t))) ∧ ¬ scalar?(t)

⊃

array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Repeatedly Skolemizing and flattening, This completes the proof of pod?_TCC1. Q.E.D.

C.41.12 Cpp_Deep_Types.uidt_void_TCC1

                                                                                                                        Terse proof for uidt_void_TCC1.
                                                                                                                        uidt_void_TCC1:

{1} uninterpreted_data_type?((#size := 0, valid? := λ (l: list[Byte], a: Address): false#))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of uidt_void_TCC1.

Q.E.D.

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

C.42.1 Cpp_Examples.spec01

Terse proof for spec01.

                                                                                                                        spec01:

{1} Valid(STATES, skip[State], STATES)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read_single_data plain_memory_read_write_single_data pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr

889 C Proof scripts

plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s if_else switch member break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt allocate_stack deallocate_stack with_new_stackvar ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state l2r n2b a2b comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec01.

Q.E.D.

C.42.2 Cpp_Examples.PRECONDITION_TCC1

                                                                                                                        Terse proof for PRECONDITION_TCC1.
                                                                                                                        PRECONDITION_TCC1:

{1} ∀ (s: State): pm`states(s) ⊃ Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

890

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        PRECONDITION_TCC1.1:

{-1} pm`states(s′)
{1} Cpp_Type?(int)

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC1.1.

                                                                                                                        PRECONDITION_TCC1.2:

{-1} pm`states(s′)
{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of PRECONDITION_TCC1.2.

Q.E.D.

C.42.3 Cpp_Examples.PRECONDITION_TCC2

                                                                                                                        Terse proof for PRECONDITION_TCC2.
                                                                                                                        PRECONDITION_TCC2:

{1} ∀ (s: State):

in_blessed_memory?(dt_bool, c, pm`rw_addr) ∧ in_blessed_memory?(dt(int), m, pm`rw_addr) ∧ in_blessed_memory?(dt(int), n, pm`rw_addr) ∧ pm`states(s) ⊃ Cpp_Type?(char) ∧ cv(non_bool_integral_enum?)(char)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        PRECONDITION_TCC2.1:

{-1} in_blessed_memory?(dt_bool, c, pm`rw_addr)
{-2} in_blessed_memory?(dt(int), m, pm`rw_addr)
{-3} in_blessed_memory?(dt(int), n, pm`rw_addr)
{-4} pm`states(s′)
{1} Cpp_Type?(char)

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields?

891 C Proof scripts

no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC2.1.

                                                                                                                        PRECONDITION_TCC2.2:

{-1} in_blessed_memory?(dt_bool, c, pm`rw_addr)
{-2} in_blessed_memory?(dt(int), m, pm`rw_addr)
{-3} in_blessed_memory?(dt(int), n, pm`rw_addr)
{-4} pm`states(s′)
{1} cv(non_bool_integral_enum?)(char)

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of PRECONDITION_TCC2.2.

Q.E.D.

C.42.4 Cpp_Examples.PRECONDITION_TCC3

                                                                                                                        Terse proof for PRECONDITION_TCC3.
                                                                                                                        PRECONDITION_TCC3:

{1} ∀ (s: State):

in_blessed_memory?(dt(char), b, pm`rw_addr) ∧ in_blessed_memory?(dt(char), a, pm`rw_addr) ∧ in_blessed_memory?(dt_bool, c, pm`rw_addr) ∧ in_blessed_memory?(dt(int), m, pm`rw_addr) ∧ in_blessed_memory?(dt(int), n, pm`rw_addr) ∧ pm`states(s)

⊃ Cpp_Type?(char)

Repeatedly Skolemizing and flattening, Using lemma PRECONDITION_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC3. Q.E.D.

C.42.5 Cpp_Examples.PRECONDITION_TCC4

                                                                                                                        Terse proof for PRECONDITION_TCC4.

892

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

                                                                                                                        PRECONDITION_TCC4:

{1} ∀ (s: State):

blocks_disjoint?(b, size_of(char), a, size_of(char)) ∧ blocks_disjoint?(a, size_of(char), b, size_of(char)) ∧ in_blessed_memory?(dt(char), b, pm`rw_addr) ∧ in_blessed_memory?(dt(char), a, pm`rw_addr) ∧ in_blessed_memory?(dt_bool, c, pm`rw_addr) ∧ in_blessed_memory?(dt(int), m, pm`rw_addr) ∧ in_blessed_memory?(dt(int), n, pm`rw_addr) ∧ pm`states(s)

⊃ Cpp_Type?(int)

Repeatedly Skolemizing and flattening, Using lemma PRECONDITION_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC4. Q.E.D.

C.42.6 Cpp_Examples.POSTCONDITION_TCC1

                                                                                                                        Terse proof for POSTCONDITION_TCC1.
                                                                                                                        POSTCONDITION_TCC1:

{1} ∀ (s: State): Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        POSTCONDITION_TCC1.1:

{1} Cpp_Type?(int)

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of POSTCONDITION_TCC1.1.

                                                                                                                        POSTCONDITION_TCC1.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of POSTCONDITION_TCC1.2.

Q.E.D.

893 C Proof scripts

C.42.7 Cpp_Examples.spec02_TCC1

Terse proof for spec02_TCC1.

                                                                                                                        spec02_TCC1:

{1} plain_memory?(pm) ⊃ range(int)(42)

Applying disjunctive simplification to flatten sequent,

Expanding the definition of range,

Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma min_int, Using lemma max_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec02_TCC1. Q.E.D.

C.42.8 Cpp_Examples.spec02

Terse proof for spec02.

                                                                                                                        spec02:

{1} plain_memory?(pm) ⊃ valid(PRECONDITION, e2s(assign(pm, dt(int))(id(n), literal(42))), POSTCONDI-TION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt

894

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r n2b a2b

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec02.

Q.E.D.

C.42.9 Cpp_Examples.spec03

Terse proof for spec03.

                                                                                                                        spec03:

{1} plain_memory?(pm) ⊃ Valid(PRECONDITION, e2s(assign(pm, dt(int))(id(n), literal(42))), POSTCONDI- TION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

895 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok compo-

896

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

sition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt

comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r n2b a2b

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec03.

Q.E.D.

C.42.10 Cpp_Examples.spec04_TCC1

Terse proof for spec04_TCC1.

                                                                                                                        spec04_TCC1:

{1} plain_memory?(pm) ⊃ range(char)(42)

Applying disjunctive simplification to flatten sequent,

Expanding the definition of range,

Expanding the definition of range_integral, Rewriting using char_binary, matching in *, Using lemma min_char, Using lemma max_char, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec04_TCC1. Q.E.D.

C.42.11 Cpp_Examples.spec04_TCC2

Terse proof for spec04_TCC2.

                                                                                                                        spec04_TCC2:

{1} plain_memory?(pm) ⊃ Cpp_Type?(char) ∧ cv(non_bool_integral_enum?)(char)

Repeatedly Skolemizing and flattening,

Hiding formulas: -1,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        spec04_TCC2.1:

{1} Cpp_Type?(char)

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1,

897 C Proof scripts

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec04_TCC2.1.

                                                                                                                        spec04_TCC2.2:

{1} cv(non_bool_integral_enum?)(char)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of spec04_TCC2.2.

Q.E.D.

C.42.12 Cpp_Examples.spec04

Terse proof for spec04.

                                                                                                                        spec04:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(char))(id(a), literal(42))) ## e2s(assign(pm, dt(char))(id(b), literal(42))), λ (s: State):

OK?(read_data(pm, dt(char))(a)(s)) ∧ data(read_data(pm, dt(char))(a)(s)) = 42)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr

898

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

plain_memory_read_read_q_data_stmt  pm_q_prop_ok_result_single  pm_q_prop_ok_result_q_expr

pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

899 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec04.

Q.E.D.

C.42.13 Cpp_Examples.spec05

Terse proof for spec05.

                                                                                                                        spec05:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt_bool)(id(c), literal(true))) ## if_else(l2r(pm, dt_bool)(id(c)),

e2s(assign(pm, dt(int))(id(n), literal(42))), skip),

POSTCONDITION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue

900

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point? Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec05. Q.E.D.

C.42.14 Cpp_Examples.spec06_TCC1

Terse proof for spec06_TCC1.

spec06_TCC1:

{1} plain_memory?(pm) ⊃ range(char)(0)

Applying disjunctive simplification to flatten sequent, Expanding the definition of range, Expanding the definition of range_integral,

901 C Proof scripts

Rewriting using char_binary, matching in *, Using lemma min_char, Using lemma max_char, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec06_TCC1. Q.E.D.

C.42.15 Cpp_Examples.spec06_TCC2

Terse proof for spec06_TCC2.

spec06_TCC2:

{1} plain_memory?(pm) ⊃ range(char)(1)

Applying disjunctive simplification to flatten sequent, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using char_binary, matching in *, Using lemma min_char, Using lemma max_char, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec06_TCC2. Q.E.D.

C.42.16 Cpp_Examples.spec06_TCC3

Terse proof for spec06_TCC3.

spec06_TCC3:

{1} plain_memory?(pm) ⊃ every[real](λ (x: real): rational_pred(x) ∧ integer_pred(x))((:1:))

Repeatedly Skolemizing and flattening, Using lemma spec04_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of spec06_TCC3. Q.E.D.

C.42.17 Cpp_Examples.spec06_TCC4

Terse proof for spec06_TCC4.

spec06_TCC4:

{1} plain_memory?(pm) ⊃ range(int)(0)

Applying disjunctive simplification to flatten sequent, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma min_int,

902

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

Using lemma max_int,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec06_TCC4.

Q.E.D.

C.42.18 Cpp_Examples.spec06

Terse proof for spec06.

                                                                                                spec06:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(char))(id(a), literal(0))) ## e2s(assign(pm, dt(char))(id(b), literal(1))) ## switch(l2r(pm, dt(char))(id(a)), (:0, 1:),

case(0) ## skip ## case(1) ## e2s(assign(pm, dt(int))(id(n), literal(42))) ## break ## default ## e2s(assign(pm, dt(int))(id(n), literal(0)))),

POSTCONDITION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue

903 C Proof scripts

break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec06.

Q.E.D.

C.42.19 Cpp_Examples.spec07

Terse proof for spec07.

904

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

                                                                                                                        spec07:

{1} valid(PRECONDITION, while(literal(true), skip), λ (s: State): false)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt

905 C Proof scripts

composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r n2b a2b

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of hang_result,

which is trivially true.

This completes the proof of spec07.

Q.E.D.

C.42.20 Cpp_Examples.N_TCC1

Terse proof for N_TCC1.

                                                                                                                        N_TCC1:

{1} 2 ≥ 0 ∧ range(int)(2)

Installing automatic rewrites from: int_binary

Trying repeated skolemization, instantiation, and if-lifting,

we get 2 subgoals:

                                                                                                                        N_TCC1.1:

{1} 2 ≤ max(range_int)

Using lemma max_int,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of N_TCC1.1.

                                                                                                                        N_TCC1.2:

{1} min(range_int) ≤ 2

Using lemma min_int,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of N_TCC1.2.

Q.E.D.

C.42.21 Cpp_Examples.range_int_values_TCC1

                                                                                                                        Terse proof for range_int_values_TCC1.

906

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

                                                                                                                        range_int_values_TCC1:

{1} ∀ (i: int): −32767 ≤ i ∧ i ≤ 32767 ⊃ Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening,

Keeping (1) and hiding *,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        range_int_values_TCC1.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of range_int_values_TCC1.1.

                                                                                                                        range_int_values_TCC1.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_int_values_TCC1.2. Q.E.D.

C.42.22 Cpp_Examples.range_int_values

                                                                                                                        Terse proof for range_int_values.
                                                                                                                        range_int_values:

{1} ∀ (i: int): −32767 ≤ i ∧ i ≤ 32767 ⊃ range(int)(i)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma max_int, Using lemma min_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_int_values. Q.E.D.

907 C Proof scripts

C.42.23 Cpp_Examples.spec08_TCC1

Terse proof for spec08_TCC1.

                                                                                                                        spec08_TCC1:

{1} plain_memory?(pm) ⊃ Cpp_Type?(int) ∧ v(non_bool_integral?)(int)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        spec08_TCC1.1:

{-1} plain_memory?(pm)
{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec08_TCC1.1.

                                                                                                                        spec08_TCC1.2:

{-1} plain_memory?(pm)
{1} v(non_bool_integral?)(int)

Hiding formulas: -1,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of spec08_TCC1.2.

Q.E.D.

C.42.24 Cpp_Examples.spec08

Terse proof for spec08.

                                                                                                                        spec08:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(int))(id(n), literal(0))) ## e2s(assign(pm, dt(int))(id(m), literal(0))) ## while(N + 1, lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),

e2s(postinc(pm, int)(id(n))) ## e2s(postinc(pm, int)(id(m)))),

λ (s: State):

OK?(read_data(pm, dt(int))(m)(s)) ⊃ data(read_data(pm, dt(int))(m)(s)) = N)

908

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok!

909 C Proof scripts

stmt_while_inv_rewrite_data_break!  stmt_while_inv_rewrite_data_return!  pm_q_prop_while!

pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: N

Installing automatic rewrites from: range_int_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec08.

Q.E.D.

C.42.25 Cpp_Examples.spec09

Terse proof for spec09.

                                                                                                                        spec09:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(int))(id(m), literal(0))) ## for(N + 1, e2s(assign(pm, dt(int))(id(n), literal(0))), lt(int)(l2r(pm, dt(int))(id(n)), literal(N)), postinc(pm, int)(id(n)), e2s(postinc(pm, int)(id(m)))),

λ (s: State):

OK?(read_data(pm, dt(int))(m)(s)) ⊃ data(read_data(pm, dt(int))(m)(s)) = N)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr

910

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok compo-

911 C Proof scripts

sition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt

comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: N

Installing automatic rewrites from: range_int_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec09.

Q.E.D.

C.42.26 Cpp_Examples.spec10_TCC1

Terse proof for spec10_TCC1.

                                                                                                                        spec10_TCC1:

{1} plain_memory?(pm) ⊃

(∀ (s_{0}: State, res: StmtResult[State]): OK?(res) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res))

Repeatedly Skolemizing and flattening,

This completes the proof of spec10_TCC1.

Q.E.D.

C.42.27 Cpp_Examples.spec10

Terse proof for spec10.

912

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        spec10:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION,

for(e2s(assign(pm, dt(int))(id(n), literal(0))), lt(int)(l2r(pm, dt(int))(id(n)), literal(N)), postinc(pm, int)(id(n)), skip)

((λ (s_{0}: State):

λ (res: StmtResult[State]): OK?(res) ∧ OK?(read_data(pm, dt(int))(n)(state(res))) ∧ 0 ≤ data(read_data(pm, dt(int))(n)(state(res))) ∧ data(read_data(pm, dt(int))(n)(state(res))) < N),

(λ (s_{0}: State):

λ (res: StmtResult[State]): OK?(res) ∧ OK?(read_data(pm, dt(int))(n)(state(res))) ∧ data(read_data(pm, dt(int))(n)(state(res))) = N),

(λ (s_{0}: State):

λ (res: StmtResult[State]): OK?(res) ∧ OK?(read_data(pm, dt(int))(n)(state(res))) ∧ data(read_data(pm, dt(int))(n)(state(res))) ≤ N),

(λ (s_{0}: State):

λ (s: State):

if OK?(read_data(pm, dt(int))(n)(s)) ∧

data(read_data(pm, dt(int))(n)(s)) ≤ N then N − data(read_data(pm, dt(int))(n)(s))

else N endif),

extend[[numfield, numfield], [int, int], bool, false]

(λ (i, j: int): i < j)),

λ (s: State):

OK?(read_data(pm, dt(int))(n)(s)) ⊃ data(read_data(pm, dt(int))(n)(s)) = N)

This completes the proof of spec10.

C.43 Proofs for Cpp_Integral_Types (types.pvs)

C.43.1 Cpp_Integral_Types.range_integral_TCC1

                                                                                                                        Terse proof for range_integral_TCC1.
                                                                                                                        range_integral_TCC1:

{1} ∀ (typ: (non_bool_integral?)):

typ = uchar ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_uchar))

Repeatedly Skolemizing and flattening, Adding type constraints for range_uchar, Keeping (-4 1) and hiding *,

913 C Proof scripts

Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC1. Q.E.D.

C.43.2 Cpp_Integral_Types.range_integral_TCC2

                                                                                                                        Terse proof for range_integral_TCC2.
                                                                                                                        range_integral_TCC2:

{1} ∀ (typ: (non_bool_integral?)):

typ = ushort ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_ushort))

Repeatedly Skolemizing and flattening, Adding type constraints for range_ushort, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC2. Q.E.D.

C.43.3 Cpp_Integral_Types.range_integral_TCC3

                                                                                                                        Terse proof for range_integral_TCC3.
                                                                                                                        range_integral_TCC3:

{1} ∀ (typ: (non_bool_integral?)):

typ = uint ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_uint))

Repeatedly Skolemizing and flattening, Adding type constraints for range_uint, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC3. Q.E.D.

C.43.4 Cpp_Integral_Types.range_integral_TCC4

                                                                                                                        Terse proof for range_integral_TCC4.
                                                                                                                        range_integral_TCC4:

{1} ∀ (typ: (non_bool_integral?)):

typ = ulong ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_ulong))

914

C.43 Proofs for Cpp_Integral_Types (types.pvs)

Repeatedly Skolemizing and flattening, Adding type constraints for range_ulong, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC4. Q.E.D.

C.43.5 Cpp_Integral_Types.range_integral_TCC5

                                                                                                                        Terse proof for range_integral_TCC5.
                                                                                                                        range_integral_TCC5:

{1} ∀ (typ: (non_bool_integral?)): typ = ulonglong ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_ulonglong))

Repeatedly Skolemizing and flattening,

Adding type constraints for range_ulonglong,

Keeping (-4 1) and hiding *,

Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC5. Q.E.D.

C.43.6 Cpp_Integral_Types.range_integral_TCC6

                                                                                                                        Terse proof for range_integral_TCC6.
                                                                                                                        range_integral_TCC6:

{1} ∀ (typ: (non_bool_integral?)): ¬ (bool?(typ) ∨

float?(typ) ∨ double?(typ) ∨ longdouble?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ))

Repeatedly Skolemizing and flattening,

Expanding the definition of non_bool_integral?, Expanding the definition of signed_integer?, Expanding the definition of unsigned_integer?,

915 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of range_integral_TCC6.

Q.E.D.

C.43.7 Cpp_Integral_Types.range_floating_point_TCC1

                                                                                                                        Terse proof for range_floating_point_TCC1.
                                                                                                                        range_floating_point_TCC1:

{1} ∀ (typ: (floating_point?)): ¬ (uchar?(typ) ∨

schar?(typ) ∨ char?(typ) ∨ short?(typ) ∨ int?(typ) ∨ long?(typ) ∨ longlong?(typ) ∨ ushort?(typ) ∨ uint?(typ) ∨ ulong?(typ) ∨ ulonglong?(typ) ∨ wchar_t?(typ) ∨ bool?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of floating_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of range_floating_point_TCC1.

Q.E.D.

C.43.8 Cpp_Integral_Types.dt_integral_TCC1

                                                                                                                        Terse proof for dt_integral_TCC1.
                                                                                                                        dt_integral_TCC1:

{1} ∀ (typ: (non_bool_integral?)):

typ = uchar ⊃ (∀ (x: int): x ≥ 0 ∧ (range_uchar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_uchar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_uchar)]((range_integral(typ)))(dt_uchar`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_uchar)

916

C.43 Proofs for Cpp_Integral_Types (types.pvs)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        dt_integral_TCC1.1:

{-1} non_bool_integral?(uchar)
{-2} uchar?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_uchar)

Adding type constraints for dt_uchar,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC1.1.1:

{-1} uninterpreted_data_type?(dt_uchar`uidt)

{-2} ∀ (d: ((range_uchar)), a: Address):

valid?(uidt(dt_uchar))(to_byte(dt_uchar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uchar))(l, a) ≡ up?(from_byte(dt_uchar)(l, a))

{-4} ∀ (d: ((range_uchar)), a: Address):

down(from_byte(dt_uchar)(to_byte(dt_uchar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uchar))(l, a_{1}) ≡ valid?(uidt(dt_uchar))(l, a_{2})

{-6} size(uidt(dt_uchar)) > 0
{-7} non_bool_integral?(uchar)
{-8} uchar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_uchar))(to_byte(dt_uchar)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC1.1.1.

917 C Proof scripts

                                                                                                                        dt_integral_TCC1.1.2:

{-1} uninterpreted_data_type?(dt_uchar`uidt)

{-2} ∀ (d: ((range_uchar)), a: Address):

valid?(uidt(dt_uchar))(to_byte(dt_uchar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uchar))(l, a) ≡ up?(from_byte(dt_uchar)(l, a))

{-4} ∀ (d: ((range_uchar)), a: Address):

down(from_byte(dt_uchar)(to_byte(dt_uchar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uchar))(l, a_{1}) ≡ valid?(uidt(dt_uchar))(l, a_{2})

{-6} size(uidt(dt_uchar)) > 0
{-7} non_bool_integral?(uchar)
{-8} uchar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_uchar)(to_byte(dt_uchar)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC1.1.2.

                                                                                                                        dt_integral_TCC1.2:

{-1} non_bool_integral?(uchar)
{-2} uchar?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_uchar)]((range_integral(uchar)))(dt_uchar`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC1.2.

                                                                                                                        dt_integral_TCC1.3:

{-1} non_bool_integral?(uchar)
{-2} uchar?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_uchar)(x) ≡ if x ≥ 0 then range_uchar(x) else false endif

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC1.3.

Q.E.D.

C.43.9 Cpp_Integral_Types.dt_integral_TCC2

                                                                                                                        Terse proof for dt_integral_TCC2.

918

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        dt_integral_TCC2:

{1} ∀ (typ: (non_bool_integral?)):

typ = schar ⊃

(∀ (x: int): (range_schar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_schar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_schar)]((range_integral(typ)))(dt_schar`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_schar)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC2.1:

{-1} non_bool_integral?(schar)
{-2} schar?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_schar)

Adding type constraints for dt_schar,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC2.1.1:

{-1} uninterpreted_data_type?(dt_schar`uidt)

{-2} ∀ (d: ((range_schar)), a: Address):

valid?(uidt(dt_schar))(to_byte(dt_schar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_schar))(l, a) ≡ up?(from_byte(dt_schar)(l, a))

{-4} ∀ (d: ((range_schar)), a: Address):

down(from_byte(dt_schar)(to_byte(dt_schar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_schar))(l, a_{1}) ≡ valid?(uidt(dt_schar))(l, a_{2})

{-6} size(uidt(dt_schar)) > 0
{-7} non_bool_integral?(schar)
{-8} schar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_schar))(to_byte(dt_schar)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC2.1.1.

919 C Proof scripts

                                                                                                                        dt_integral_TCC2.1.2:

{-1} uninterpreted_data_type?(dt_schar`uidt)

{-2} ∀ (d: ((range_schar)), a: Address):

valid?(uidt(dt_schar))(to_byte(dt_schar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_schar))(l, a) ≡ up?(from_byte(dt_schar)(l, a))

{-4} ∀ (d: ((range_schar)), a: Address):

down(from_byte(dt_schar)(to_byte(dt_schar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_schar))(l, a_{1}) ≡ valid?(uidt(dt_schar))(l, a_{2})

{-6} size(uidt(dt_schar)) > 0
{-7} non_bool_integral?(schar)
{-8} schar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_schar)(to_byte(dt_schar)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC2.1.2.

                                                                                                                        dt_integral_TCC2.2:

{-1} non_bool_integral?(schar)
{-2} schar?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_schar)]((range_integral(schar)))(dt_schar`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC2.2. Q.E.D.

C.43.10 Cpp_Integral_Types.dt_integral_TCC3

                                                                                                                        Terse proof for dt_integral_TCC3.
                                                                                                                        dt_integral_TCC3:

{1} ∀ (typ: (non_bool_integral?)):

typ = char ⊃

(∀ (x: int): (range_char)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_char)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_char)]((range_integral(typ)))(dt_char`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_char)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

920

C.43 Proofs for Cpp_Integral_Types (types.pvs)

we get 2 subgoals:

dt_integral_TCC3.1:

{-1} non_bool_integral?(char)
{-2} char?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_char)

Adding type constraints for dt_char, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC3.1.1:

{-1} uninterpreted_data_type?(dt_char`uidt)

{-2} ∀ (d: ((range_char)), a: Address):

valid?(uidt(dt_char))(to_byte(dt_char)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_char))(l, a) ≡ up?(from_byte(dt_char)(l, a))

{-4} ∀ (d: ((range_char)), a: Address):

down(from_byte(dt_char)(to_byte(dt_char)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_char))(l, a_{1}) ≡ valid?(uidt(dt_char))(l, a_{2})

{-6} size(uidt(dt_char)) > 0
{-7} non_bool_integral?(char)
{-8} char?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_char))(to_byte(dt_char)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC3.1.1.

dt_integral_TCC3.1.2:

{-1} uninterpreted_data_type?(dt_char`uidt)

{-2} ∀ (d: ((range_char)), a: Address):

valid?(uidt(dt_char))(to_byte(dt_char)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_char))(l, a) ≡ up?(from_byte(dt_char)(l, a))

{-4} ∀ (d: ((range_char)), a: Address):

down(from_byte(dt_char)(to_byte(dt_char)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_char))(l, a_{1}) ≡ valid?(uidt(dt_char))(l, a_{2})

{-6} size(uidt(dt_char)) > 0
{-7} non_bool_integral?(char)
{-8} char?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_char)(to_byte(dt_char)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral,

921 C Proof scripts

which is trivially true. This completes the proof of dt_integral_TCC3.1.2.

dt_integral_TCC3.2:

{-1} non_bool_integral?(char)
{-2} char?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_char)]((range_integral(char)))(dt_char`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC3.2. Q.E.D.

C.43.11 Cpp_Integral_Types.dt_integral_TCC4

Terse proof for dt_integral_TCC4.
dt_integral_TCC4:

{1} ∀ (typ: (non_bool_integral?)):

typ = short ⊃

(∀ (x: int): (range_short)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_short)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_short)]((range_integral(typ)))(dt_short`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_short)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC4.1:

{-1} non_bool_integral?(short)
{-2} short?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_short)

Adding type constraints for dt_short, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

922

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                dt_integral_TCC4.1.1:

{-1} uninterpreted_data_type?(dt_short`uidt)

{-2} ∀ (d: ((range_short)), a: Address):

valid?(uidt(dt_short))(to_byte(dt_short)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_short))(l, a) ≡ up?(from_byte(dt_short)(l, a))

{-4} ∀ (d: ((range_short)), a: Address):

down(from_byte(dt_short)(to_byte(dt_short)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_short))(l, a_{1}) ≡ valid?(uidt(dt_short))(l, a_{2})

{-6} size(uidt(dt_short)) > 0
{-7} non_bool_integral?(short)
{-8} short?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_short))(to_byte(dt_short)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC4.1.1.

                                                                                                dt_integral_TCC4.1.2:

{-1} uninterpreted_data_type?(dt_short`uidt)

{-2} ∀ (d: ((range_short)), a: Address):

valid?(uidt(dt_short))(to_byte(dt_short)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_short))(l, a) ≡ up?(from_byte(dt_short)(l, a))

{-4} ∀ (d: ((range_short)), a: Address):

down(from_byte(dt_short)(to_byte(dt_short)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_short))(l, a_{1}) ≡ valid?(uidt(dt_short))(l, a_{2})

{-6} size(uidt(dt_short)) > 0
{-7} non_bool_integral?(short)
{-8} short?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_short)(to_byte(dt_short)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC4.1.2.

                                                                                                dt_integral_TCC4.2:

{-1} non_bool_integral?(short)
{-2} short?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_short)]((range_integral(short)))(dt_short`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

923 C Proof scripts

This completes the proof of dt_integral_TCC4.2.

Q.E.D.

C.43.12 Cpp_Integral_Types.dt_integral_TCC5

                                                                                                                        Terse proof for dt_integral_TCC5.
                                                                                                                        dt_integral_TCC5:

{1} ∀ (typ: (non_bool_integral?)):

typ = int ⊃

(∀ (x: int): (range_int)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_int)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_int)]((range_integral(typ)))(dt_int`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_int)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC5.1:

{-1} non_bool_integral?(int)
{-2} int?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_int)

Adding type constraints for dt_int,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC5.1.1:

{-1} uninterpreted_data_type?(dt_int`uidt)

{-2} ∀ (d: ((range_int)), a: Address):

valid?(uidt(dt_int))(to_byte(dt_int)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_int))(l, a) ≡ up?(from_byte(dt_int)(l, a))

{-4} ∀ (d: ((range_int)), a: Address):

down(from_byte(dt_int)(to_byte(dt_int)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_int))(l, a_{1}) ≡ valid?(uidt(dt_int))(l, a_{2})

{-6} size(uidt(dt_int)) > 0
{-7} non_bool_integral?(int)
{-8} int?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_int))(to_byte(dt_int)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

924

C.43 Proofs for Cpp_Integral_Types (types.pvs)

This completes the proof of dt_integral_TCC5.1.1.

                                                                                                                        dt_integral_TCC5.1.2:

{-1} uninterpreted_data_type?(dt_int`uidt)

{-2} ∀ (d: ((range_int)), a: Address):

valid?(uidt(dt_int))(to_byte(dt_int)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_int))(l, a) ≡ up?(from_byte(dt_int)(l, a))

{-4} ∀ (d: ((range_int)), a: Address):

down(from_byte(dt_int)(to_byte(dt_int)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_int))(l, a_{1}) ≡ valid?(uidt(dt_int))(l, a_{2})

{-6} size(uidt(dt_int)) > 0
{-7} non_bool_integral?(int)
{-8} int?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_int)(to_byte(dt_int)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC5.1.2.

                                                                                                                        dt_integral_TCC5.2:

{-1} non_bool_integral?(int)
{-2} int?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_int)]((range_integral(int)))(dt_int`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC5.2. Q.E.D.

C.43.13 Cpp_Integral_Types.dt_integral_TCC6

                                                                                                                        Terse proof for dt_integral_TCC6.
                                                                                                                        dt_integral_TCC6:

{1} ∀ (typ: (non_bool_integral?)):

typ = long ⊃

(∀ (x: int): (range_long)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_long)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_long)]((range_integral(typ)))(dt_long`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_long)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

925 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC6.1:

{-1} non_bool_integral?(long)
{-2} long?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_long)

Adding type constraints for dt_long,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC6.1.1:

{-1} uninterpreted_data_type?(dt_long`uidt)

{-2} ∀ (d: ((range_long)), a: Address):

valid?(uidt(dt_long))(to_byte(dt_long)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_long))(l, a) ≡ up?(from_byte(dt_long)(l, a))

{-4} ∀ (d: ((range_long)), a: Address):

down(from_byte(dt_long)(to_byte(dt_long)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_long))(l, a_{1}) ≡ valid?(uidt(dt_long))(l, a_{2})

{-6} size(uidt(dt_long)) > 0
{-7} non_bool_integral?(long)
{-8} long?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_long))(to_byte(dt_long)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC6.1.1.

                                                                                                                        dt_integral_TCC6.1.2:

{-1} uninterpreted_data_type?(dt_long`uidt)

{-2} ∀ (d: ((range_long)), a: Address):

valid?(uidt(dt_long))(to_byte(dt_long)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_long))(l, a) ≡ up?(from_byte(dt_long)(l, a))

{-4} ∀ (d: ((range_long)), a: Address):

down(from_byte(dt_long)(to_byte(dt_long)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_long))(l, a_{1}) ≡ valid?(uidt(dt_long))(l, a_{2})

{-6} size(uidt(dt_long)) > 0
{-7} non_bool_integral?(long)
{-8} long?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_long)(to_byte(dt_long)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

926

C.43 Proofs for Cpp_Integral_Types (types.pvs)

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC6.1.2.

                                                                                                                        dt_integral_TCC6.2:

{-1} non_bool_integral?(long)
{-2} long?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_long)]((range_integral(long)))(dt_long`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC6.2. Q.E.D.

C.43.14 Cpp_Integral_Types.dt_integral_TCC7

                                                                                                                        Terse proof for dt_integral_TCC7.
                                                                                                                        dt_integral_TCC7:

{1} ∀ (typ: (non_bool_integral?)): typ = longlong ⊃ (∀ (x: int): (range_longlong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_longlong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_longlong)]((range_integral(typ)))(dt_longlong`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_longlong)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC7.1:

{-1} non_bool_integral?(longlong)
{-2} longlong?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_longlong)

Adding type constraints for dt_longlong, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

927 C Proof scripts

                                                                                                                        dt_integral_TCC7.1.1:

{-1} uninterpreted_data_type?(dt_longlong`uidt)

{-2} ∀ (d: ((range_longlong)), a: Address):

valid?(uidt(dt_longlong))(to_byte(dt_longlong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longlong))(l, a) ≡ up?(from_byte(dt_longlong)(l, a))

{-4} ∀ (d: ((range_longlong)), a: Address):

down(from_byte(dt_longlong)(to_byte(dt_longlong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longlong))(l, a_{1}) ≡ valid?(uidt(dt_longlong))(l, a_{2})

{-6} size(uidt(dt_longlong)) > 0
{-7} non_bool_integral?(longlong)
{-8} longlong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_longlong))(to_byte(dt_longlong)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC7.1.1.

                                                                                                                        dt_integral_TCC7.1.2:

{-1} uninterpreted_data_type?(dt_longlong`uidt)

{-2} ∀ (d: ((range_longlong)), a: Address):

valid?(uidt(dt_longlong))(to_byte(dt_longlong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longlong))(l, a) ≡ up?(from_byte(dt_longlong)(l, a))

{-4} ∀ (d: ((range_longlong)), a: Address):

down(from_byte(dt_longlong)(to_byte(dt_longlong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longlong))(l, a_{1}) ≡ valid?(uidt(dt_longlong))(l, a_{2})

{-6} size(uidt(dt_longlong)) > 0
{-7} non_bool_integral?(longlong)
{-8} longlong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_longlong)(to_byte(dt_longlong)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC7.1.2.

                                                                                                                        dt_integral_TCC7.2:

{-1} non_bool_integral?(longlong)
{-2} longlong?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_longlong)]((range_integral(longlong)))(dt_longlong`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

928

C.43 Proofs for Cpp_Integral_Types (types.pvs)

This completes the proof of dt_integral_TCC7.2.

Q.E.D.

C.43.15 Cpp_Integral_Types.dt_integral_TCC8

                                                                                                                        Terse proof for dt_integral_TCC8.
                                                                                                                        dt_integral_TCC8:

{1} ∀ (typ: (non_bool_integral?)): typ = ushort ⊃ (∀ (x: int): x ≥ 0 ∧ (range_ushort)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_ushort)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_ushort)]((range_integral(typ)))(dt_ushort`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_ushort)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        dt_integral_TCC8.1:

{-1} non_bool_integral?(ushort)
{-2} ushort?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_ushort)

Adding type constraints for dt_ushort,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC8.1.1:

{-1} uninterpreted_data_type?(dt_ushort`uidt)

{-2} ∀ (d: ((range_ushort)), a: Address):

valid?(uidt(dt_ushort))(to_byte(dt_ushort)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ushort))(l, a) ≡ up?(from_byte(dt_ushort)(l, a))

{-4} ∀ (d: ((range_ushort)), a: Address):

down(from_byte(dt_ushort)(to_byte(dt_ushort)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ushort))(l, a_{1}) ≡ valid?(uidt(dt_ushort))(l, a_{2})

{-6} size(uidt(dt_ushort)) > 0
{-7} non_bool_integral?(ushort)
{-8} ushort?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_ushort))(to_byte(dt_ushort)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

929 C Proof scripts

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC8.1.1.

                                                                                                                        dt_integral_TCC8.1.2:

{-1} uninterpreted_data_type?(dt_ushort`uidt)

{-2} ∀ (d: ((range_ushort)), a: Address):

valid?(uidt(dt_ushort))(to_byte(dt_ushort)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ushort))(l, a) ≡ up?(from_byte(dt_ushort)(l, a))

{-4} ∀ (d: ((range_ushort)), a: Address):

down(from_byte(dt_ushort)(to_byte(dt_ushort)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ushort))(l, a_{1}) ≡ valid?(uidt(dt_ushort))(l, a_{2})

{-6} size(uidt(dt_ushort)) > 0
{-7} non_bool_integral?(ushort)
{-8} ushort?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_ushort)(to_byte(dt_ushort)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC8.1.2.

                                                                                                                        dt_integral_TCC8.2:

{-1} non_bool_integral?(ushort)
{-2} ushort?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_ushort)]((range_integral(ushort)))(dt_ushort`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC8.2.

                                                                                                                        dt_integral_TCC8.3:

{-1} non_bool_integral?(ushort)
{-2} ushort?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_ushort)(x) ≡ if x ≥ 0 then range_ushort(x) else false endif

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC8.3.

Q.E.D.

C.43.16 Cpp_Integral_Types.dt_integral_TCC9

                                                                                                                        Terse proof for dt_integral_TCC9.

930

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        dt_integral_TCC9:

{1} ∀ (typ: (non_bool_integral?)):

typ = uint ⊃

(∀ (x: int): x ≥ 0 ∧ (range_uint)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_uint)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_uint)]((range_integral(typ)))(dt_uint`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_uint)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        dt_integral_TCC9.1:

{-1} non_bool_integral?(uint)
{-2} uint?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_uint)

Adding type constraints for dt_uint,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC9.1.1:

{-1} uninterpreted_data_type?(dt_uint`uidt)

{-2} ∀ (d: ((range_uint)), a: Address):

valid?(uidt(dt_uint))(to_byte(dt_uint)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uint))(l, a) ≡ up?(from_byte(dt_uint)(l, a))

{-4} ∀ (d: ((range_uint)), a: Address):

down(from_byte(dt_uint)(to_byte(dt_uint)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uint))(l, a_{1}) ≡ valid?(uidt(dt_uint))(l, a_{2})

{-6} size(uidt(dt_uint)) > 0
{-7} non_bool_integral?(uint)
{-8} uint?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_uint))(to_byte(dt_uint)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC9.1.1.

931 C Proof scripts

                                                                                                                        dt_integral_TCC9.1.2:

{-1} uninterpreted_data_type?(dt_uint`uidt)

{-2} ∀ (d: ((range_uint)), a: Address):

valid?(uidt(dt_uint))(to_byte(dt_uint)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uint))(l, a) ≡ up?(from_byte(dt_uint)(l, a))

{-4} ∀ (d: ((range_uint)), a: Address):

down(from_byte(dt_uint)(to_byte(dt_uint)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uint))(l, a_{1}) ≡ valid?(uidt(dt_uint))(l, a_{2})

{-6} size(uidt(dt_uint)) > 0
{-7} non_bool_integral?(uint)
{-8} uint?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_uint)(to_byte(dt_uint)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC9.1.2.

                                                                                                                        dt_integral_TCC9.2:

{-1} non_bool_integral?(uint)
{-2} uint?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_uint)]((range_integral(uint)))(dt_uint`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC9.2.

                                                                                                                        dt_integral_TCC9.3:

{-1} non_bool_integral?(uint)
{-2} uint?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_uint)(x) ≡ if x ≥ 0 then range_uint(x) else false endif

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC9.3.

Q.E.D.

C.43.17 Cpp_Integral_Types.dt_integral_TCC10

                                                                                                                        Terse proof for dt_integral_TCC10.

932

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        dt_integral_TCC10:

{1} ∀ (typ: (non_bool_integral?)):

typ = ulong ⊃

(∀ (x: int): x ≥ 0 ∧ (range_ulong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_ulong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_ulong)]((range_integral(typ)))(dt_ulong`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_ulong)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        dt_integral_TCC10.1:

{-1} non_bool_integral?(ulong)
{-2} ulong?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_ulong)

Adding type constraints for dt_ulong,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC10.1.1:

{-1} uninterpreted_data_type?(dt_ulong`uidt)

{-2} ∀ (d: ((range_ulong)), a: Address):

valid?(uidt(dt_ulong))(to_byte(dt_ulong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulong))(l, a) ≡ up?(from_byte(dt_ulong)(l, a))

{-4} ∀ (d: ((range_ulong)), a: Address):

down(from_byte(dt_ulong)(to_byte(dt_ulong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulong))(l, a_{1}) ≡ valid?(uidt(dt_ulong))(l, a_{2})

{-6} size(uidt(dt_ulong)) > 0
{-7} non_bool_integral?(ulong)
{-8} ulong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_ulong))(to_byte(dt_ulong)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC10.1.1.

933 C Proof scripts

                                                                                                                        dt_integral_TCC10.1.2:

{-1} uninterpreted_data_type?(dt_ulong`uidt)

{-2} ∀ (d: ((range_ulong)), a: Address):

valid?(uidt(dt_ulong))(to_byte(dt_ulong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulong))(l, a) ≡ up?(from_byte(dt_ulong)(l, a))

{-4} ∀ (d: ((range_ulong)), a: Address):

down(from_byte(dt_ulong)(to_byte(dt_ulong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulong))(l, a_{1}) ≡ valid?(uidt(dt_ulong))(l, a_{2})

{-6} size(uidt(dt_ulong)) > 0
{-7} non_bool_integral?(ulong)
{-8} ulong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_ulong)(to_byte(dt_ulong)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC10.1.2.

                                                                                                                        dt_integral_TCC10.2:

{-1} non_bool_integral?(ulong)
{-2} ulong?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_ulong)]((range_integral(ulong)))(dt_ulong`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC10.2.

                                                                                                                        dt_integral_TCC10.3:

{-1} non_bool_integral?(ulong)
{-2} ulong?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_ulong)(x) ≡ if x ≥ 0 then range_ulong(x) else false endif

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC10.3.

Q.E.D.

C.43.18 Cpp_Integral_Types.dt_integral_TCC11

                                                                                                                        Terse proof for dt_integral_TCC11.

934

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        dt_integral_TCC11:

{1} ∀ (typ: (non_bool_integral?)): typ = ulonglong ⊃ (∀ (x: int): x ≥ 0 ∧ (range_ulonglong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_ulonglong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_ulonglong)]

((range_integral(typ)))(dt_ulonglong`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_ulonglong)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        dt_integral_TCC11.1:

{-1} non_bool_integral?(ulonglong)
{-2} ulonglong?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_ulonglong)

Adding type constraints for dt_ulonglong, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        dt_integral_TCC11.1.1:

{-1} uninterpreted_data_type?(dt_ulonglong`uidt)

{-2} ∀ (d: ((range_ulonglong)), a: Address):

valid?(uidt(dt_ulonglong))(to_byte(dt_ulonglong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulonglong))(l, a) ≡ up?(from_byte(dt_ulonglong)(l, a))

{-4} ∀ (d: ((range_ulonglong)), a: Address):

down(from_byte(dt_ulonglong)(to_byte(dt_ulonglong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulonglong))(l, a_{1}) ≡ valid?(uidt(dt_ulonglong))(l, a_{2})

{-6} size(uidt(dt_ulonglong)) > 0
{-7} non_bool_integral?(ulonglong)
{-8} ulonglong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_ulonglong))(to_byte(dt_ulonglong)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC11.1.1.

935 C Proof scripts

                                                                                                                        dt_integral_TCC11.1.2:

{-1} uninterpreted_data_type?(dt_ulonglong`uidt)

{-2} ∀ (d: ((range_ulonglong)), a: Address):

valid?(uidt(dt_ulonglong))(to_byte(dt_ulonglong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulonglong))(l, a) ≡ up?(from_byte(dt_ulonglong)(l, a))

{-4} ∀ (d: ((range_ulonglong)), a: Address):

down(from_byte(dt_ulonglong)(to_byte(dt_ulonglong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulonglong))(l, a_{1}) ≡ valid?(uidt(dt_ulonglong))(l, a_{2})

{-6} size(uidt(dt_ulonglong)) > 0
{-7} non_bool_integral?(ulonglong)
{-8} ulonglong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_ulonglong)(to_byte(dt_ulonglong)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC11.1.2.

                                                                                                                        dt_integral_TCC11.2:

{-1} non_bool_integral?(ulonglong)
{-2} ulonglong?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_ulonglong)]((range_integral(ulonglong)))(dt_ulonglong`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC11.2.

                                                                                                                        dt_integral_TCC11.3:

{-1} non_bool_integral?(ulonglong)
{-2} ulonglong?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_ulonglong)(x) ≡ if x ≥ 0 then range_ulonglong(x) else false endif

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_integral_TCC11.3.

Q.E.D.

C.43.19 Cpp_Integral_Types.dt_integral_TCC12

                                                                                                                        Terse proof for dt_integral_TCC12.

936

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        dt_integral_TCC12:

{1} ∀ (typ: (non_bool_integral?)): typ = wchar_t ⊃ (∀ (x: int): (range_wchar_t)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_wchar_t)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_wchar_t)]((range_integral(typ)))(dt_wchar_t`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_wchar_t)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_integral,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        dt_integral_TCC12.1:

{-1} non_bool_integral?(wchar_t)
{-2} wchar_t?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_wchar_t)

Adding type constraints for dt_wchar_t, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        dt_integral_TCC12.1.1:

{-1} uninterpreted_data_type?(dt_wchar_t`uidt)

{-2} ∀ (d: ((range_wchar_t)), a: Address):

valid?(uidt(dt_wchar_t))(to_byte(dt_wchar_t)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_wchar_t))(l, a) ≡ up?(from_byte(dt_wchar_t)(l, a))

{-4} ∀ (d: ((range_wchar_t)), a: Address):

down(from_byte(dt_wchar_t)(to_byte(dt_wchar_t)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_wchar_t))(l, a_{1}) ≡ valid?(uidt(dt_wchar_t))(l, a_{2})

{-6} size(uidt(dt_wchar_t)) > 0
{-7} non_bool_integral?(wchar_t)
{-8} wchar_t?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_wchar_t))(to_byte(dt_wchar_t)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC12.1.1.

937 C Proof scripts

                                                                                                                        dt_integral_TCC12.1.2:

{-1} uninterpreted_data_type?(dt_wchar_t`uidt)

{-2} ∀ (d: ((range_wchar_t)), a: Address):

valid?(uidt(dt_wchar_t))(to_byte(dt_wchar_t)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_wchar_t))(l, a) ≡ up?(from_byte(dt_wchar_t)(l, a))

{-4} ∀ (d: ((range_wchar_t)), a: Address):

down(from_byte(dt_wchar_t)(to_byte(dt_wchar_t)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_wchar_t))(l, a_{1}) ≡ valid?(uidt(dt_wchar_t))(l, a_{2})

{-6} size(uidt(dt_wchar_t)) > 0
{-7} non_bool_integral?(wchar_t)
{-8} wchar_t?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_wchar_t)(to_byte(dt_wchar_t)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_integral,

which is trivially true.

This completes the proof of dt_integral_TCC12.1.2.

                                                                                                                        dt_integral_TCC12.2:

{-1} non_bool_integral?(wchar_t)
{-2} wchar_t?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_wchar_t)]((range_integral(wchar_t)))(dt_wchar_t`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC12.2. Q.E.D.

C.43.20 Cpp_Integral_Types.dt_floating_point_TCC1

                                                                                                                        Terse proof for dt_floating_point_TCC1.
                                                                                                                        dt_floating_point_TCC1:

{1} ∀ (typ: (floating_point?)): typ = float ⊃ (∀ (x: extended_real): (range_float)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x: extended_real): (range_float)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_float)]((range_floating_point(typ)))(dt_float`from_byte(x_{1}))) ∧ pod_data_type?[(range_floating_point(typ))](dt_float)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_floating_point,

Applying propositional simplification,

938

C.43 Proofs for Cpp_Integral_Types (types.pvs)

we get 2 subgoals:

                                                                                                                        dt_floating_point_TCC1.1:

{-1} floating_point?(float)
{-2} typ′ = float
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_float)]((range_floating_point(float)))(dt_float`from_byte(x_{1}))

Repeatedly Skolemizing and flattening,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of range_floating_point,

which is trivially true.

                                                                                                                        This completes the proof of dt_floating_point_TCC1.1.
                                                                                                                        dt_floating_point_TCC1.2:

{-1} floating_point?(float)
{-2} typ′ = float
{1} pod_data_type?[((range_floating_point(typ′)))](dt_float)

Adding type constraints for dt_float,

Expanding the definition of pod_data_type?,

Applying propositional simplification,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_floating_point_TCC1.2.1:

{-1} uninterpreted_data_type?(dt_float`uidt)

{-2} ∀ (d: ((range_float)), a: Address):

valid?(uidt(dt_float))(to_byte(dt_float)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_float))(l, a) ≡ up?(from_byte(dt_float)(l, a))

{-4} ∀ (d: ((range_float)), a: Address):

down(from_byte(dt_float)(to_byte(dt_float)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_float))(l, a_{1}) ≡ valid?(uidt(dt_float))(l, a_{2})

{-6} size(uidt(dt_float)) > 0
{-7} floating_point?(float)
{-8} typ′ = float

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): valid?(uidt(dt_float))(to_byte(dt_float)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_floating_point,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of dt_floating_point_TCC1.2.1.

939 C Proof scripts

                                                                                                                        dt_floating_point_TCC1.2.2:

{-1} uninterpreted_data_type?(dt_float`uidt)

{-2} ∀ (d: ((range_float)), a: Address):

valid?(uidt(dt_float))(to_byte(dt_float)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_float))(l, a) ≡ up?(from_byte(dt_float)(l, a))

{-4} ∀ (d: ((range_float)), a: Address):

down(from_byte(dt_float)(to_byte(dt_float)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_float))(l, a_{1}) ≡ valid?(uidt(dt_float))(l, a_{2})

{-6} size(uidt(dt_float)) > 0
{-7} floating_point?(float)
{-8} typ′ = float

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): down(from_byte(dt_float)(to_byte(dt_float)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_floating_point,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of dt_floating_point_TCC1.2.2.

Q.E.D.

C.43.21 Cpp_Integral_Types.dt_floating_point_TCC2

                                                                                                                        Terse proof for dt_floating_point_TCC2.
                                                                                                                        dt_floating_point_TCC2:

{1} ∀ (typ: (floating_point?)): typ = double ⊃ (∀ (x: extended_real): (range_double)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x: extended_real): (range_double)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_double)]

((range_floating_point(typ)))(dt_double`from_byte(x_{1}))) ∧ pod_data_type?[(range_floating_point(typ))](dt_double)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of range_floating_point,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_floating_point_TCC2.1:

{-1} floating_point?(double)
{-2} typ′ = double
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_double)]((range_floating_point(double)))(dt_double`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range_floating_point,

940

C.43 Proofs for Cpp_Integral_Types (types.pvs)

which is trivially true.

This completes the proof of dt_floating_point_TCC2.1.
dt_floating_point_TCC2.2:

{-1} floating_point?(double)
{-2} typ′ = double
{1} pod_data_type?[((range_floating_point(typ′)))](dt_double)

Adding type constraints for dt_double, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC2.2.1:

{-1} uninterpreted_data_type?(dt_double`uidt)

{-2} ∀ (d: ((range_double)), a: Address):

valid?(uidt(dt_double))(to_byte(dt_double)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_double))(l, a) ≡ up?(from_byte(dt_double)(l, a))

{-4} ∀ (d: ((range_double)), a: Address):

down(from_byte(dt_double)(to_byte(dt_double)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_double))(l, a_{1}) ≡ valid?(uidt(dt_double))(l, a_{2})

{-6} size(uidt(dt_double)) > 0
{-7} floating_point?(double)
{-8} typ′ = double

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): valid?(uidt(dt_double))(to_byte(dt_double)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC2.2.1.
dt_floating_point_TCC2.2.2:

{-1} uninterpreted_data_type?(dt_double`uidt)

{-2} ∀ (d: ((range_double)), a: Address):

valid?(uidt(dt_double))(to_byte(dt_double)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_double))(l, a) ≡ up?(from_byte(dt_double)(l, a))

{-4} ∀ (d: ((range_double)), a: Address):

down(from_byte(dt_double)(to_byte(dt_double)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_double))(l, a_{1}) ≡ valid?(uidt(dt_double))(l, a_{2})

{-6} size(uidt(dt_double)) > 0
{-7} floating_point?(double)
{-8} typ′ = double

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): down(from_byte(dt_double)(to_byte(dt_double)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point,

941 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC2.2.2.

Q.E.D.

C.43.22 Cpp_Integral_Types.dt_floating_point_TCC3

Terse proof for dt_floating_point_TCC3.
dt_floating_point_TCC3:

{1} ∀ (typ: (floating_point?)): typ = longdouble ⊃ (∀ (x: extended_real): (range_longdouble)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x: extended_real): (range_longdouble)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_longdouble)] ((range_floating_point(typ)))(dt_longdouble`from_byte(x_{1}))) ∧ pod_data_type?[(range_floating_point(typ))](dt_longdouble)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_floating_point, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC3.1:

{-1} floating_point?(longdouble)
{-2} typ′ = longdouble
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_longdouble)] ((range_floating_point(longdouble)))(dt_longdouble`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range_floating_point, which is trivially true.

This completes the proof of dt_floating_point_TCC3.1.
dt_floating_point_TCC3.2:

{-1} floating_point?(longdouble)
{-2} typ′ = longdouble
{1} pod_data_type?[((range_floating_point(typ′)))](dt_longdouble)

Adding type constraints for dt_longdouble, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

942

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                dt_floating_point_TCC3.2.1:

{-1} uninterpreted_data_type?(dt_longdouble`uidt)

{-2} ∀ (d: ((range_longdouble)), a: Address):

valid?(uidt(dt_longdouble))(to_byte(dt_longdouble)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longdouble))(l, a) ≡ up?(from_byte(dt_longdouble)(l, a))

{-4} ∀ (d: ((range_longdouble)), a: Address):

down(from_byte(dt_longdouble)(to_byte(dt_longdouble)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longdouble))(l, a_{1}) ≡ valid?(uidt(dt_longdouble))(l, a_{2})

{-6} size(uidt(dt_longdouble)) > 0
{-7} floating_point?(longdouble)
{-8} typ′ = longdouble

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): valid?(uidt(dt_longdouble))(to_byte(dt_longdouble)(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_floating_point,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                This completes the proof of dt_floating_point_TCC3.2.1.
                                                                                                dt_floating_point_TCC3.2.2:

{-1} uninterpreted_data_type?(dt_longdouble`uidt)

{-2} ∀ (d: ((range_longdouble)), a: Address):

valid?(uidt(dt_longdouble))(to_byte(dt_longdouble)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longdouble))(l, a) ≡ up?(from_byte(dt_longdouble)(l, a))

{-4} ∀ (d: ((range_longdouble)), a: Address):

down(from_byte(dt_longdouble)(to_byte(dt_longdouble)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longdouble))(l, a_{1}) ≡ valid?(uidt(dt_longdouble))(l, a_{2})

{-6} size(uidt(dt_longdouble)) > 0
{-7} floating_point?(longdouble)
{-8} typ′ = longdouble

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): down(from_byte(dt_longdouble)(to_byte(dt_longdouble)(d, a), a)) = d

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range_floating_point,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                This completes the proof of dt_floating_point_TCC3.2.2.

Q.E.D.

C.43.23 Cpp_Integral_Types.range_integral_unsigned_TCC1

                                                                                              Terse proof for range_integral_unsigned_TCC1.
                                                                                                range_integral_unsigned_TCC1:

{1} ∀ (typ: (unsigned_integer?)): non_bool_integral?(typ)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                This completes the proof of range_integral_unsigned_TCC1.

943 C Proof scripts

Q.E.D.

C.43.24 Cpp_Integral_Types.range_integral_unsigned

                                                                                                                        Terse proof for range_integral_unsigned.
                                                                                                                        range_integral_unsigned:

{1} ∀ (typ: (unsigned_integer?)):

(∀ (x: int): range_integral(typ)(x) ⊃ x ≥ 0) ∧ is_finite[nat](range_integral(typ)) ∧ ¬ empty?[nat](range_integral(typ))

Repeatedly Skolemizing and flattening,

Case splitting on FORALL (x: int): range_integral(typ!1)(x) IMPLIES x >= 0,

we get 3 subgoals:

                                                                                                                        range_integral_unsigned.1:

{-1} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-2} unsigned_integer?(typ′)
{1} (∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0) ∧

is_finite[nat](range_integral(typ′)) ∧ ¬ empty?[nat](range_integral(typ′))

Adding type constraints for range_integral(typ!1),

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        range_integral_unsigned.1.1:

{-1} is_finite[int](range_integral(typ′))
{-2} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-3} unsigned_integer?(typ′)
{1} is_finite[nat](range_integral(typ′))
{2} empty?[int](range_integral(typ′))

Expanding the definition of is_finite,

which is trivially true.

                                                                                                                        This completes the proof of range_integral_unsigned.1.1.
                                                                                                                        range_integral_unsigned.1.2:

{-1} empty?[nat](range_integral(typ′))
{-2} is_finite[int](range_integral(typ′))
{-3} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-4} unsigned_integer?(typ′)
{1} empty?[int](range_integral(typ′))

Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

                                                                                                                        range_integral_unsigned.1.2.1:

{-1} integer_pred(x′)
{-2} is_finite[int](range_integral(typ′))
{-3} (x′ ∈ range_integral(typ′))
{-4} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-5} unsigned_integer?(typ′)
{1} (x′ ∈ range_integral(typ′))

944

C.43 Proofs for Cpp_Integral_Types (types.pvs)

Expanding the definition of member,

which is trivially true.

                                                                                                                        This completes the proof of range_integral_unsigned.1.2.1.
                                                                                                                        range_integral_unsigned.1.2.2:

{-1} integer_pred(x′)
{-2} is_finite[int](range_integral(typ′))
{-3} (x′ ∈ range_integral(typ′))
{-4} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-5} unsigned_integer?(typ′)
{1} x′ ≥ 0

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of member,

which is trivially true.

                                                                                                                        This completes the proof of range_integral_unsigned.1.2.2.
                                                                                                                        range_integral_unsigned.2:

{-1} unsigned_integer?(typ′)
{1} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{2} (∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0) ∧

is_finite[nat](range_integral(typ′)) ∧ ¬ empty?[nat](range_integral(typ′))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Expanding the definition of unsigned_integer?, Expanding the definition of range_integral, Adding type constraints for range_uchar, Adding type constraints for range_ulonglong, Adding type constraints for range_ulong, Adding type constraints for range_ushort, Adding type constraints for range_uint, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of range_integral_unsigned.2.
                                                                                                                        range_integral_unsigned.3:

{-1} unsigned_integer?(typ′)
{1} non_bool_integral?(typ′)
{2} (∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0) ∧

is_finite[nat](range_integral(typ′)) ∧ ¬ empty?[nat](range_integral(typ′))

Expanding the definition of non_bool_integral?,

which is trivially true.

                                                                                                                        This completes the proof of range_integral_unsigned.3.

Q.E.D.

C.43.25 Cpp_Integral_Types.max_value_TCC1

                                                                                                                        Terse proof for max_value_TCC1.
                                                                                                                        max_value_TCC1:

{1} ∀ (typ: (non_bool_integral?)):

¬ empty?[real](extend[real, int, bool, false](range_integral(typ)))

945 C Proof scripts

Repeatedly Skolemizing and flattening,

Adding type constraints for range_integral(typ!1),

Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_TCC1. Q.E.D.

C.43.26 Cpp_Integral_Types.max_value_TCC2

                                                                                                                        Terse proof for max_value_TCC2.
                                                                                                                        max_value_TCC2:

{1} ∀ (typ: (non_bool_integral?)): rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ))))

Repeatedly Skolemizing and flattening,

Adding type constraints for max[real, <=](extend[real, int, bool, FALSE](range_integral(typ!1))), we get 2 subgoals:

                                                                                                                        max_value_TCC2.1:

{-1} extend[real, int, bool, false] (range_integral(typ′)) (max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{-2} ∀ (x: real):

extend[real, int, bool, false](range_integral(typ′))(x) ⊃ x ≤ max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))

{-3} non_bool_integral?(typ′)

{1} rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of max_value_TCC2.1.

                                                                                                                        max_value_TCC2.2:

{-1} empty?[real](extend[real, int, bool, false](range_integral(typ′)))
{-2} non_bool_integral?(typ′)

{1} rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Using lemma max_value_TCC1,

This completes the proof of max_value_TCC2.2.

Q.E.D.

C.43.27 Cpp_Integral_Types.min_value_TCC1

                                                                                                                        Terse proof for min_value_TCC1.

946

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        min_value_TCC1:

{1} ∀ (typ: (non_bool_integral?)): rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ))))

Repeatedly Skolemizing and flattening,

Adding type constraints for min[real, <=](extend[real, int, bool, FALSE](range_integral(typ!1))), we get 2 subgoals:

                                                                                                                        min_value_TCC1.1:

{-1} extend[real, int, bool, false] (range_integral(typ′)) (min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{-2} ∀ (x: real):

extend[real, int, bool, false](range_integral(typ′))(x) ⊃ min[real, ≤](extend[real, int, bool, false](range_integral(typ′))) ≤ x

{-3} non_bool_integral?(typ′)

{1} rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of min_value_TCC1.1.

                                                                                                                        min_value_TCC1.2:

{-1} empty?[real](extend[real, int, bool, false](range_integral(typ′)))
{-2} non_bool_integral?(typ′)

{1} rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Using lemma max_value_TCC1,

This completes the proof of min_value_TCC1.2.

Q.E.D.

C.43.28 Cpp_Integral_Types.max_value_unsigned

                                                                                                                        Terse proof for max_value_unsigned.
                                                                                                                        max_value_unsigned:

{1} ∀ (typ: (unsigned_integer?)): max_value(typ) ≥ 0

Repeatedly Skolemizing and flattening, Expanding the definition of max_value, Using lemma range_integral_unsigned, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, we get 2 subgoals:

947 C Proof scripts

                                                                                                                        max_value_unsigned.1:

{-1} range_integral(typ′)(max(extend[real, int, bool, false](range_integral(typ′)))) ⊃

max(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

{-2} unsigned_integer?(typ′)
{1} empty?[nat](range_integral(typ′))
{2} max(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Adding type constraints for max(extend[real, int, bool, FALSE](range_integral(typ!1))),

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of max_value_unsigned.1.

                                                                                                                        max_value_unsigned.2:

{-1} unsigned_integer?(typ′)

{1} rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{2} empty?[nat](range_integral(typ′))
{3} max(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Using lemma max_value_TCC2,

This completes the proof of max_value_unsigned.2.

Q.E.D.

C.43.29 Cpp_Integral_Types.min_value_unsigned

                                                                                                                        Terse proof for min_value_unsigned.
                                                                                                                        min_value_unsigned:

{1} ∀ (typ: (unsigned_integer?)): min_value(typ) ≥ 0

Expanding the definition of min_value, Repeatedly Skolemizing and flattening, Using lemma range_integral_unsigned, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, we get 2 subgoals:

                                                                                                                        min_value_unsigned.1:

{-1} range_integral(typ′)(min(extend[real, int, bool, false](range_integral(typ′)))) ⊃

min(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

{-2} unsigned_integer?(typ′)
{1} empty?[nat](range_integral(typ′))
{2} min(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Adding type constraints for min(extend[real, int, bool, FALSE](range_integral(typ!1))),

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of min_value_unsigned.1.

948

C.43 Proofs for Cpp_Integral_Types (types.pvs)

                                                                                                                        min_value_unsigned.2:

{-1} unsigned_integer?(typ′)

{1} rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{2} empty?[nat](range_integral(typ′))
{3} min(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Using lemma min_value_TCC1,

This completes the proof of min_value_unsigned.2.

Q.E.D.

C.43.30 Cpp_Integral_Types.max_value_bits_TCC1

                                                                                                                        Terse proof for max_value_bits_TCC1.
                                                                                                                        max_value_bits_TCC1:

{1} well_founded?(λ (x: (cv(unsigned_integer?)), y: (cv(unsigned_integer?))): restrict [[Cpp_Type_, Cpp_Type_], [(cv(unsigned_integer?)), (cv(unsigned_integer?))], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, (cv(unsigned_integer?))],

Expanding the definition of restrict,

which is trivially true.

This completes the proof of max_value_bits_TCC1.

Q.E.D.

C.43.31 Cpp_Integral_Types.max_value_bits_TCC2

                                                                                                                        Terse proof for max_value_bits_TCC2.
                                                                                                                        max_value_bits_TCC2:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_): typ = const(t) ⊃ cv(unsigned_integer?)(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of max_value_bits_TCC2.

Q.E.D.

C.43.32 Cpp_Integral_Types.max_value_bits_TCC3

                                                                                                                        Terse proof for max_value_bits_TCC3.
                                                                                                                        max_value_bits_TCC3:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_):

typ = const(t) ⊃

restrict

[[Cpp_Type_, Cpp_Type_], [(cv(unsigned_integer?)), (cv(unsigned_integer?))],

boolean] (≪)(t, typ)

949 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of max_value_bits_TCC3.

Q.E.D.

C.43.33 Cpp_Integral_Types.max_value_bits_TCC4

                                                                                                                        Terse proof for max_value_bits_TCC4.
                                                                                                                        max_value_bits_TCC4:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_): typ = volatile(t) ⊃ cv(unsigned_integer?)(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of max_value_bits_TCC4.

Q.E.D.

C.43.34 Cpp_Integral_Types.max_value_bits_TCC5

                                                                                                                        Terse proof for max_value_bits_TCC5.
                                                                                                                        max_value_bits_TCC5:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_):

typ = volatile(t) ⊃

restrict

[[Cpp_Type_, Cpp_Type_], [(cv(unsigned_integer?)), (cv(unsigned_integer?))],

boolean] (≪)(t, typ)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of max_value_bits_TCC5.

Q.E.D.

C.43.35 Cpp_Integral_Types.max_value_bits_TCC6

                                                                                                                        Terse proof for max_value_bits_TCC6.

950

C.44 Proofs for Cpp_Types (types.pvs)

                                                                                                                        max_value_bits_TCC6:

{1} ∀ (typ: (cv(unsigned_integer?))): ¬ (schar?(typ) ∨ char?(typ) ∨ short?(typ) ∨ int?(typ) ∨ long?(typ) ∨ longlong?(typ) ∨ wchar_t?(typ) ∨ bool?(typ) ∨ float?(typ) ∨ double?(typ) ∨ longdouble?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of max_value_bits_TCC6.

Q.E.D.

C.44 Proofs for Cpp_Types (types.pvs)

C.44.1 Cpp_Types.alignment_TCC1

                                                                                                                        Terse proof for alignment_TCC1.
                                                                                                                        alignment_TCC1:

{1} well_founded?(λ (x: Cpp_Type, y: Cpp_Type):

restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Type],

Expanding the definition of restrict,

which is trivially true.

This completes the proof of alignment_TCC1.

Q.E.D.

C.44.2 Cpp_Types.alignment_TCC2

                                                                                                                        Terse proof for alignment_TCC2.
                                                                                                                        alignment_TCC2:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_, s: nat): typ = array_type(t, s) ⊃ array?(typ)

951 C Proof scripts

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC2.

Q.E.D.

C.44.3 Cpp_Types.alignment_TCC3

                                                                                                                        Terse proof for alignment_TCC3.
                                                                                                                        alignment_TCC3:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = pointer(t) ⊃ pointer?(typ)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC3.

Q.E.D.

C.44.4 Cpp_Types.alignment_TCC4

                                                                                                                        Terse proof for alignment_TCC4.
                                                                                                                        alignment_TCC4:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = reference(t) ⊃ reference?(typ)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC4.

Q.E.D.

C.44.5 Cpp_Types.alignment_TCC5

                                                                                                                        Terse proof for alignment_TCC5.
                                                                                                                        alignment_TCC5:

{1} ∀ (typ: Cpp_Type, n: string, a: bool): typ = class(n, a) ⊃ class?(typ)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC5.

Q.E.D.

C.44.6 Cpp_Types.alignment_TCC6

                                                                                                                        Terse proof for alignment_TCC6.
                                                                                                                        alignment_TCC6:

{1} ∀ (typ: Cpp_Type, n: string): typ = union(n) ⊃ union?(typ)

952

C.44 Proofs for Cpp_Types (types.pvs)

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC6.

Q.E.D.

C.44.7 Cpp_Types.alignment_TCC7

                                                                                                                        Terse proof for alignment_TCC7.
                                                                                                                        alignment_TCC7:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_, bo: nat, s: posnat):

typ = bitfield(t, bo, s) ⊃ bitfield?(typ)

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC7.

Q.E.D.

C.44.8 Cpp_Types.alignment_TCC8

                                                                                                                        Terse proof for alignment_TCC8.
                                                                                                                        alignment_TCC8:

{1} ∀ (typ: Cpp_Type, n: string, t: Cpp_Type_, m: posnat, c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ enum?(typ)

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC8.

Q.E.D.

C.44.9 Cpp_Types.alignment_TCC9

                                                                                                                        Terse proof for alignment_TCC9.
                                                                                                                        alignment_TCC9:

{1} ∀ (typ: Cpp_Type, t: (class?), m: Cpp_Type_):

typ = pointer_to_member(t, m) ⊃ pointer_to_member?(typ)

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of alignment_TCC9.

Q.E.D.

C.44.10 Cpp_Types.alignment_TCC10

                                                                                                                        Terse proof for alignment_TCC10.
                                                                                                                        alignment_TCC10:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

953 C Proof scripts

Repeatedly Skolemizing and flattening,

Replacing using formula -2,

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC10. Q.E.D.

C.44.11 Cpp_Types.alignment_TCC11

                                                                                                                        Terse proof for alignment_TCC11.
                                                                                                                        alignment_TCC11:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = const(t) ⊃

restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Replacing using formula -2, Expanding the definition of «, which is trivially true. This completes the proof of alignment_TCC11. Q.E.D.

C.44.12 Cpp_Types.alignment_TCC12

                                                                                                                        Terse proof for alignment_TCC12.
                                                                                                                        alignment_TCC12:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!2), Expanding the definition of subterm, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC12. Q.E.D.

C.44.13 Cpp_Types.alignment_TCC13

                                                                                                                        Terse proof for alignment_TCC13.

954

C.44 Proofs for Cpp_Types (types.pvs)

                                                                                                                        alignment_TCC13:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = volatile(t) ⊃

restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Replacing using formula -2, Expanding the definition of «, which is trivially true. This completes the proof of alignment_TCC13. Q.E.D.

C.44.14 Cpp_Types.pointer_to_aligned_object_TCC1

                                                                                                                        Terse proof for pointer_to_aligned_object_TCC1.
                                                                                                                        pointer_to_aligned_object_TCC1:

{1} ∀ (p: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))): not_null?(p)(ptr_val) ⊃ array?(cv_base(p)) ∨ pointer?(cv_base(p)) ∨ reference?(cv_base(p)) ∨ bitfield?(cv_base(p)) ∨ enum?(cv_base(p)) ∨ pointer_to_member?(cv_base(p)) ∨ const?(cv_base(p)) ∨ volatile?(cv_base(p))

Repeatedly Skolemizing and flattening,

Keeping (-2 2) and hiding *,

Rewriting using cv_base_result, matching in *,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of pointer_to_aligned_object_TCC1.

Q.E.D.

C.44.15 Cpp_Types.pointer_to_aligned_object_TCC2

                                                                                                                        Terse proof for pointer_to_aligned_object_TCC2.
                                                                                                                        pointer_to_aligned_object_TCC2:

{1} ∀ (p: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))): not_null?(p)(ptr_val) ⊃ Cpp_Type?(typ(cv_base(p)))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!1), Splitting conjunctions, we get 2 subgoals:

955 C Proof scripts

                                                                                                                        pointer_to_aligned_object_TCC2.1:

{-1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

{-2} cv(pointer?)(p′)
{-3} range_pointer(cv_base(p′))(ptr_val′)
{-4} not_null?(p′)(ptr_val′)
{-5} subterm(t′, typ(cv_base(p′)))

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

956

C.44 Proofs for Cpp_Types (types.pvs)

which is trivially true.

                                                                                                                        This completes the proof of pointer_to_aligned_object_TCC2.1.
                                                                                                                        pointer_to_aligned_object_TCC2.2:

{-1} cv(pointer?)(p′)
{-2} range_pointer(cv_base(p′))(ptr_val′)
{-3} not_null?(p′)(ptr_val′)
{-4} subterm(t′, typ(cv_base(p′)))
{1} subterm(t′, p′)

{2} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Hiding formulas: 2,

Using lemma subterm_cv_base, Using lemma subterm_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma cv_base_result, we get 2 subgoals:

                                                                                                                        pointer_to_aligned_object_TCC2.2.1:

{-1} pointer?(cv_base(p′))
{-2} subterm(cv_base(p′), p′)
{-3} cv(pointer?)(p′)
{-4} range_pointer(cv_base(p′))(ptr_val′)
{-5} not_null?(p′)(ptr_val′)
{-6} subterm(t′, typ(cv_base(p′)))
{1} subterm(t′, cv_base(p′))
{2} subterm(t′, p′)

957 C Proof scripts

Expanding the definition of subterm,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of pointer_to_aligned_object_TCC2.2.1.
                                                                                                                        pointer_to_aligned_object_TCC2.2.2:

{-1} subterm(cv_base(p′), p′)
{-2} cv(pointer?)(p′)
{-3} range_pointer(cv_base(p′))(ptr_val′)
{-4} not_null?(p′)(ptr_val′)
{-5} subterm(t′, typ(cv_base(p′)))
{1} (pointer? ⊆ interpreted?)
{2} subterm(t′, cv_base(p′))
{3} subterm(t′, p′)

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of pointer_to_aligned_object_TCC2.2.2.

Q.E.D.

C.44.16 Cpp_Types.pointer_to_aligned_object_TCC3

                                                                                                                        Terse proof for pointer_to_aligned_object_TCC3.
                                                                                                                        pointer_to_aligned_object_TCC3:

{1} ∀ (p: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))):

not_null?(p)(ptr_val) ⊃ up?[Memory_Address](address_of(p)(ptr_val))

Repeatedly Skolemizing and flattening,

Rewriting using address_of_spec, matching in *,

                                                                                                                        This completes the proof of pointer_to_aligned_object_TCC3.

Q.E.D.

C.44.17 Cpp_Types.align_array_of_type_TCC1

                                                                                                                        Terse proof for align_array_of_type_TCC1.
                                                                                                                        align_array_of_type_TCC1:

{1} ∀ (a: Cpp_Subtype(array?)):

array?(a) ∨ pointer?(a) ∨ reference?(a) ∨ bitfield?(a) ∨ enum?(a) ∨ pointer_to_member?(a) ∨ const?(a) ∨ volatile?(a)

Repeatedly Skolemizing and flattening,

                                                                                                                        This completes the proof of align_array_of_type_TCC1.

Q.E.D.

C.44.18 Cpp_Types.align_array_of_type_TCC2

                                                                                                                        Terse proof for align_array_of_type_TCC2.

958

C.44 Proofs for Cpp_Types (types.pvs)

                                                                                                                        align_array_of_type_TCC2:

{1} ∀ (a: Cpp_Subtype(array?)): Cpp_Type?(typ(a))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!1), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of align_array_of_type_TCC2.

Q.E.D.

C.44.19 Cpp_Types.range_TCC1

Terse proof for range_TCC1.

                                                                                                                        range_TCC1:

{1} well_founded?(λ (x: Cpp_Subtype(cv(non_bool_integral_enum?)),

y: Cpp_Subtype(cv(non_bool_integral_enum?))): restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Subtype(cv(non_bool_integral_enum?))], Expanding the definition of restrict, which is trivially true. This completes the proof of range_TCC1. Q.E.D.

C.44.20 Cpp_Types.range_TCC2

Terse proof for range_TCC2.

                                                                                                                        range_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), n: string, t: Cpp_Type_, m: pos-

nat,

c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ enum?(typ)

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of range_TCC2.

Q.E.D.

C.44.21 Cpp_Types.range_TCC3

Terse proof for range_TCC3.

959 C Proof scripts

                                                                                                                        range_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t) ∧ cv(non_bool_integral_enum?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

                                                                                                                        range_TCC3.1:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Replacing using formula -4, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC3.1.

                                                                                                                        range_TCC3.2:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = const(t′)
{1} cv(non_bool_integral_enum?)(t′)

Replacing using formula -3,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_TCC3.2.

Q.E.D.

C.44.22 Cpp_Types.range_TCC4

Terse proof for range_TCC4.

                                                                                                                        range_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of «, which is trivially true. This completes the proof of range_TCC4.

960

C.44 Proofs for Cpp_Types (types.pvs)

Q.E.D.

C.44.23 Cpp_Types.range_TCC5

Terse proof for range_TCC5.

range_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t) ∧ cv(non_bool_integral_enum?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

range_TCC5.1:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Replacing using formula -4, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC5.1.

range_TCC5.2:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(non_bool_integral_enum?)(t′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_TCC5.2. Q.E.D.

C.44.24 Cpp_Types.range_TCC6

Terse proof for range_TCC6.

range_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)),

Cpp_Subtype(cv(non_bool_integral_enum?))], boolean]

(≪)(t, typ)

Repeatedly Skolemizing and flattening,

C Proof scripts

Replacing using formula -3, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_TCC6. Q.E.D.

C.44.25 Cpp_Types.range_TCC7

Terse proof for range_TCC7.

range_TCC7:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))):

¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ enum?(typ) ⊃ non_bool_integral?(typ)

Repeatedly Skolemizing and flattening, Expanding the definition of cv, Expanding the definition of v, Expanding the definition of c, Expanding the definition of non_bool_integral_enum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC7. Q.E.D.

C.44.26 Cpp_Types.range_cv_base_TCC1

Terse proof for range_cv_base_TCC1.
range_cv_base_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))): cv(non_bool_integral_enum?)(cv_base(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of cv, Expanding the definition of c, Applying disjunctive simplification to flatten sequent, Expanding the definition of v, Hiding formulas: (2 3 4), Applying propositional simplification, we get 5 subgoals:

range_cv_base_TCC1.1:

{-1} non_bool_integral_enum?(typ′)
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base_TCC1.1.1:

{-1} non_bool_integral_enum?(typ′)
{-2} const?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

962

C.44 Proofs for Cpp_Types (types.pvs)

Hiding formulas: 1,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.1.1.

                                                                                                range_cv_base_TCC1.1.2:

{-1} non_bool_integral_enum?(typ′)
{-2} volatile?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Hiding formulas: 1,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.1.2.

                                                                                                range_cv_base_TCC1.2:

{-1} const?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                range_cv_base_TCC1.2.1:

{-1} const?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} const?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.2.1.

                                                                                                range_cv_base_TCC1.2.2:

{-1} const?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.2.2.

                                                                                                range_cv_base_TCC1.3:

{-1} non_bool_integral_enum?(typ′)
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                range_cv_base_TCC1.3.1:

{-1} non_bool_integral_enum?(typ′)
{-2} const?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

963 C Proof scripts

Keeping (-2 -1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.3.1.

                                                                                                                        range_cv_base_TCC1.3.2:

{-1} non_bool_integral_enum?(typ′)
{-2} volatile?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Keeping (-2 -1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.3.2.

                                                                                                                        range_cv_base_TCC1.4:

{-1} volatile?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

                                                                                                                        range_cv_base_TCC1.4.1:

{-1} volatile?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} const?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.4.1.

                                                                                                                        range_cv_base_TCC1.4.2:

{-1} volatile?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.4.2.

                                                                                                                        range_cv_base_TCC1.5:

{-1} const?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

964

C.44 Proofs for Cpp_Types (types.pvs)

                                                                                                                        range_cv_base_TCC1.5.1:

{-1} const?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{-4} const?(typ(typ(typ′)))
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Keeping (-4 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.5.1.

                                                                                                                        range_cv_base_TCC1.5.2:

{-1} const?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{-4} volatile?(typ(typ(typ′)))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ(typ′)))))

Keeping (-4 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.5.2. Q.E.D.

C.44.27 Cpp_Types.range_cv_base

Terse proof for range_cv_base.

                                                                                                                        range_cv_base:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))): range(typ) = range(cv_base(typ))

Repeatedly Skolemizing and flattening,

Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

                                                                                                                        range_cv_base.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        range_cv_base.1.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{-3} const?(typ′)
{1} range(typ′) = range(cv_base(typ(typ′)))

Keeping (-2 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

965 C Proof scripts

This completes the proof of range_cv_base.1.1.

                                                                                                                        range_cv_base.1.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{-3} volatile?(typ′)
{1} range(typ′) = range(cv_base(typ(typ′)))

Keeping (-2 -3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.1.2.

                                                                                                                        range_cv_base.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of range, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

                                                                                                                        range_cv_base.2.1:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{-4} const?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-3 -4) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.2.1.

                                                                                                                        range_cv_base.2.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{-4} volatile?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-3 -4) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.2.2.

                                                                                                                        range_cv_base.3:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of range, Expanding the definition of range,

966

C.44 Proofs for Cpp_Types (types.pvs)

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        range_cv_base.3.1:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{-5} const?(typ(typ(typ′)))
{1} range(typ(typ(typ′))) = range(cv_base(typ(typ(typ(typ′)))))

Keeping (-4 -5) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.3.1.

                                                                                                                        range_cv_base.3.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{-5} volatile?(typ(typ(typ′)))
{1} range(typ(typ(typ′))) = range(cv_base(typ(typ(typ(typ′)))))

Keeping (-4 -5) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.3.2.

                                                                                                                        range_cv_base.4:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

                                                                                                                        range_cv_base.4.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{-4} const?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-2 -4) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.4.1.

967 C Proof scripts

                                                                                                                        range_cv_base.4.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{-4} volatile?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-2 -4) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_cv_base.4.2.

Q.E.D.

C.44.28 Cpp_Types.dt_non_bool_integral_enum_TCC1

                                                                                                                        Terse proof for dt_non_bool_integral_enum_TCC1.
                                                                                                                        dt_non_bool_integral_enum_TCC1:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?), n: string, t: Cpp_Type_, m: pos-

nat,

c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ enum?(typ)

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of dt_non_bool_integral_enum_TCC1.

Q.E.D.

C.44.29 Cpp_Types.dt_non_bool_integral_enum_TCC2

                                                                                                                        Terse proof for dt_non_bool_integral_enum_TCC2.
                                                                                                                        dt_non_bool_integral_enum_TCC2:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?), n: string, t: Cpp_Type_, m: pos-

nat,

c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ (∀ (x: int): range_enum(typ)(x) ≡ range(typ)(x)) ∧ (∀ (x: int): range_enum(typ)(x) ≡ range(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ)))]((range(typ)))(dt_enum(typ)`from_byte(x_{1}))) ∧ interpreted_data_type?[(range(typ))](dt_enum(typ))

Repeatedly Skolemizing and flattening,

Replacing using formula -4,

Expanding the definition of range,

Adding type constraints for dt_enum(enum(n!1, t!1, m!1, c!1)),

we get 2 subgoals:

968

C.44 Proofs for Cpp_Types (types.pvs)

                                                                                                                        dt_non_bool_integral_enum_TCC2.1:

{-1} pod_data_type?[((range_enum(enum(n′, t′, m′, c′))))]

(dt_enum(enum(n′, t′, m′, c′)))

{-2} Cpp_Type?(enum(n′, t′, m′, c′))
{-3} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-4} m′ > 0
{-5} typ′ = enum(n′, t′, m′, c′)

{1} (∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ′)))] (range_enum(enum(n′, t′, m′, c′)))

(dt_enum(enum(n′, t′, m′, c′))`from_byte(x_{1})))

∧ interpreted_data_type?[((range(typ′)))](dt_enum(enum(n′, t′, m′, c′)))

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        dt_non_bool_integral_enum_TCC2.1.1:

{-1} pod_data_type?[((range_enum(enum(n′, t′, m′, c′))))]

(dt_enum(enum(n′, t′, m′, c′)))

{-2} Cpp_Type?(enum(n′, t′, m′, c′))
{-3} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-4} m′ > 0
{-5} typ′ = enum(n′, t′, m′, c′)

{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ′)))] (range_enum(enum(n′, t′, m′, c′)))

(dt_enum(enum(n′, t′, m′, c′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of dt_non_bool_integral_enum_TCC2.1.1.
                                                                                                                        dt_non_bool_integral_enum_TCC2.1.2:

{-1} pod_data_type?[((range_enum(enum(n′, t′, m′, c′))))]

(dt_enum(enum(n′, t′, m′, c′)))

{-2} Cpp_Type?(enum(n′, t′, m′, c′))
{-3} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-4} m′ > 0
{-5} typ′ = enum(n′, t′, m′, c′)
{1} interpreted_data_type?[((range(typ′)))](dt_enum(enum(n′, t′, m′, c′)))

Expanding the definition of pod_data_type?,

Applying disjunctive simplification to flatten sequent,

Keeping (-1 -7 1) and hiding *,

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

969 C Proof scripts

                                                                                                                        dt_non_bool_integral_enum_TCC2.1.2.1:

{-1} uninterpreted_data_type?(dt_enum(enum(n′, t′, m′, c′))`uidt)
{-2} ∀ (d: ((range_enum(enum(n′, t′, m′, c′)))), a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))(l, a) ≡ up?(from_byte(dt_enum(enum(n′, t′, m′, c′)))(l, a))

{-4} ∀ (d: ((range_enum(enum(n′, t′, m′, c′)))), a: Address): down(from_byte(dt_enum(enum(n′, t′, m′, c′)))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a))

= d {-5} typ′ = enum(n′, t′, m′, c′)

{1} ∀ (d: ((range(typ′))), a

C.107 Proofs for IterationStatements1 (statements.pvs)

nonzero_min_while_termination_point:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State): (∃ (n: nat): while_termination_point?(b_ex, body, s)(n)) ∧ ¬ min[nat](while_termination_point?(b_ex, body, s)) = 0 ⊃ OK?(b_ex(s)) ∧ data(b_ex(s))

Repeatedly Skolemizing and flattening,

Rewriting using min_def, matching in *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of nonzero_min_while_termination_point.

Q.E.D.

C.107.6 IterationStatements1.while_as_if_while

Terse proof for while_as_if_while.
while_as_if_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): while(b_ex, body) = if_else(b_ex, body ## catch_continue ## while(b_ex, body) ## catch_break, skip)

Expanding the definition of while,

Expanding the definition of if_else,

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

we get 3 subgoals:

1261 C Proof scripts

while_as_if_while.1:

{1} if ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′,

body′)

## e2s(b_ex′) ## catch_break) (x′)

else Hang endif = (b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif))

(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

1262

C.107 Proofs for IterationStatements1 (statements.pvs)

while_as_if_while.1.1:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{1} (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (x′)

= (b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif))

(x′)

Case splitting on min(while_termination_point?(b_ex!1, body!1, x!1)) = 0,

we get 2 subgoals:

1263 C Proof scripts

while_as_if_while.1.1.1:

{-1} min(while_termination_point?(b_ex′, body′, x′)) = 0
{-2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{1} (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (x′)

= (b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif))

(x′)

Replacing using formula -1,

Rewriting using min_def, matching in *,

Expanding the definition of minimum?,

Expanding the definition of while_termination_point?,

Expanding the definition of iterate_while,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.1.1.

1264

C.107 Proofs for IterationStatements1 (statements.pvs)

while_as_if_while.1.1.2:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (x′)

= (b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif))

(x′)

Using lemma nonzero_min_while_termination_point,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of iterate_while,

Expanding the definition of ##,

Expanding the definition of lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

1265 C Proof scripts

while_as_if_while.1.1.2.1:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{-4} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(lift(e2s(b_ex′))

(lift(iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′))

(catch_continue(body′(state(e2s(b_ex′)(x′)))))))

= catch_break(lift(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then catch_break(lift(e2s(b_ex′))

(iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, s)), b_ex′, body′)

(s)))

else Hang endif)

(catch_continue(body′(state(b_ex′(x′))))))

Expanding the definition of e2s,

Expanding the definition of lift,

Case splitting on OK?(catch_continue(body!1(state(b_ex!1(x!1))))),

we get 2 subgoals:

1266

C.107 Proofs for IterationStatements1 (statements.pvs)

while_as_if_while.1.1.2.1.1:

{-1} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-3} OK?(b_ex′(x′))
{-4} data(b_ex′(x′))
{-5} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(cases cases catch_continue(body′(state(b_ex′(x′)))) of OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, state_1)(n)

then catch_break(cases iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1) of

OK(state_1): e2s(b_ex′)(state_1) else iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1)

endcases)

else Hang endif

else catch_continue(body′(state(b_ex′(x′))))

endcases)

Simplifying, rewriting, and recording with decision procedures,

Case splitting on EXISTS (n: nat): while_termination_point?(b_ex!1, body!1, state(catch_continue (body!1(state(b_ex!1(x!1)))))) (n),

we get 2 subgoals:

1267 C Proof scripts

                                                                                                                   while_as_if_while.1.1.2.1.1.1:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

if ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n) then catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′))))))

endcases))

else catch_break(Hang)

endif

1268

C.107 Proofs for IterationStatements1 (statements.pvs)

Replacing using formula -1,

Case splitting on min(while_termination_point?(b_ex!1, body!1, x!1)) - 1 = min(while_termination_point?(b_ex!1, body!1, state(catch_continue (body!1(state(b_ex!1(x!1))))))),

we get 2 subgoals:

1269 C Proof scripts

                                                                                                                        while_as_if_while.1.1.2.1.1.1.1:

{-1} min(while_termination_point? (b_ex′, body′, x′)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{-2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state (b_ex′

(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state

(b_ex′(x′))))))

endcases))

1270

C.107 Proofs for IterationStatements1 (statements.pvs)

Replacing using formula -1,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.1.1.

1271 C Proof scripts

                                                                                                                        while_as_if_while.1.1.2.1.1.1.2:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))

{1} min(while_termination_point? (b_ex′, body′, x′)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

{3} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state (b_ex′

(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state

(b_ex′(x′))))))

endcases))

1272

C.107 Proofs for IterationStatements1 (statements.pvs)

Hiding formulas: 3,

Rewriting using min_plus1, matching in *,

we get 2 subgoals:

                                                                                                                        while_as_if_while.1.1.2.1.1.1.2.1:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))

{1} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) = 0

Case splitting on (LAMBDA (n: nat): while_termination_point?(b_ex!1, body!1, x!1)(1 + n)) = while_termination_point?(b_ex!1, body!1, state(catch_continue (body!1(state(b_ex!1(x!1)))))),

we get 2 subgoals:

                                                                                                                        while_as_if_while.1.1.2.1.1.1.2.1.1:

{-1} (λ (n: nat): while_termination_point?(b_ex′, body′, x′)(1 + n)) =

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′))))))

{-2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))

{1} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) = 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.1.2.1.1.

1273 C Proof scripts

                                                                                                                        while_as_if_while.1.1.2.1.1.1.2.1.2:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))

{1} (λ (n: nat): while_termination_point?(b_ex′, body′, x′)(1 + n)) =

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′))))))

{2} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{3} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) = 0

Hiding formulas: (2 3),

Applying decompose-equality,

Expanding the definition of while_termination_point?,

Expanding the definition of iterate_while,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.1.2.1.2.
                                                                                                                        while_as_if_while.1.1.2.1.1.1.2.2:

{-1} while_termination_point?(b_ex′, body′, x′)(0)
{-2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))

{1} min(while_termination_point? (b_ex′, body′, x′)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

Hiding formulas: 1,

Rewriting using min_def, matching in *,

Expanding the definition of minimum?,

which is trivially true.

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.1.2.2.

1274

C.107 Proofs for IterationStatements1 (statements.pvs)

                                                                                                                        while_as_if_while.1.1.2.1.1.2:

{-1} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-3} OK?(b_ex′(x′))
{-4} data(b_ex′(x′))
{-5} OK?(e2s(b_ex′)(x′))
{1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

{3} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

if ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n) then catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′))))))

endcases))

else catch_break(Hang)

endif

1275 C Proof scripts

Hiding formulas: 3,

Repeatedly Skolemizing and flattening,

Case splitting on n!1 = 0,

we get 2 subgoals:

                                                                                                                        while_as_if_while.1.1.2.1.1.2.1:

{-1} n′ = 0
{-2} n′ ≥ 0
{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} while_termination_point?(b_ex′, body′, x′)(n′)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))
{1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

Replacing using formula -1,

Rewriting using min_def, matching in *, Expanding the definition of minimum?, which is trivially true.

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.2.1.
                                                                                                                        while_as_if_while.1.1.2.1.1.2.2:

{-1} n′ ≥ 0
{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} while_termination_point?(b_ex′, body′, x′)(n′)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} n′ = 0
{2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{3} min(while_termination_point?(b_ex′, body′, x′)) = 0

Instantiating the top quantifier in 2 with the terms: n′ − 1,

we get 2 subgoals:

                                                                                                                        while_as_if_while.1.1.2.1.1.2.2.1:

{-1} n′ ≥ 0
{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} while_termination_point?(b_ex′, body′, x′)(n′)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} n′ = 0

{2} while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n′ − 1)

{3} min(while_termination_point?(b_ex′, body′, x′)) = 0

1276

C.107 Proofs for IterationStatements1 (statements.pvs)

Hiding formulas: 3,

Expanding the definition of while_termination_point?,

Expanding the definition of iterate_while,

Applying disjunctive simplification to flatten sequent,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.2.2.1.

                                                                                                                        while_as_if_while.1.1.2.1.1.2.2.2:

{-1} n′ ≥ 0
{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} while_termination_point?(b_ex′, body′, x′)(n′)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} n′ − 1 ≥ 0
{2} n′ = 0
{3} min(while_termination_point?(b_ex′, body′, x′)) = 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.1.2.2.2.

1277 C Proof scripts

                                                                                                                        while_as_if_while.1.1.2.1.2:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{-4} OK?(e2s(b_ex′)(x′))
{1} OK?(catch_continue(body′(state(b_ex′(x′)))))
{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

{3} catch_break(cases cases catch_continue(body′(state(b_ex′(x′)))) of OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, state_1)(n)

then catch_break(cases iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1)

endcases)

else Hang endif

else catch_continue(body′(state(b_ex′(x′))))

endcases)

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.1.2.

1278

C.107 Proofs for IterationStatements1 (statements.pvs)

                                                                                                                        while_as_if_while.1.1.2.2:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0
{2} OK?(e2s(b_ex′)(x′))

{3} catch_break(lift(e2s(b_ex′))

(lift(iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′))

(catch_continue(e2s(b_ex′)(x′)))))

=

catch_break(lift(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then catch_break(lift(e2s(b_ex′))

(iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, s)),

b_ex′, body′)

(s)))

else Hang endif)

(catch_continue(body′(state(b_ex′(x′))))))

Expanding the definition of e2s,

which is trivially true.

                                                                                                                        This completes the proof of while_as_if_while.1.1.2.2.
                                                                                                                        while_as_if_while.1.2:

{1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{2} Hang?((b_ex′ ##
(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif))

(x′))

Copying formula number: 1 Copying formula number: 1

1279 C Proof scripts

Instantiating the top quantifier in 1 with the terms: 0, Instantiating the top quantifier in 2 with the terms: 1, Expanding the definition of while_termination_point?, Expanding the definition of iterate_while, Expanding the definition of iterate_while, Expanding the definition of skip, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on EXISTS (n: nat): while_termination_point?(b_ex!1, body!1, state((e2s(b_ex!1) ##

body!1 ## catch_continue ## (LAMBDA (s): OK(s))) (x!1))) (n), we get 2 subgoals:

                                                                                                                        while_as_if_while.1.2.1:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′)))

(n)

{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{-4} OK?((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))(x′))

{-5} OK?(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{-6} data(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{2} Hang?((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else λ (s: State): OK(s)

endif)) (x′))

Repeatedly Skolemizing and flattening,

Instantiating the top quantifier in 1 with the terms: (n′ + 1),

Expanding the definition of while_termination_point?,

Expanding the definition of iterate_while,

Applying disjunctive simplification to flatten sequent, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_as_if_while.1.2.1.

1280

C.107 Proofs for IterationStatements1 (statements.pvs)

while_as_if_while.1.2.2:

{-1} OK?(b_ex′(x′))
{-2} data(b_ex′(x′))
{-3} OK?((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))(x′))

{-4} OK?(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{-5} data(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s))) (x′)))

(n)

{2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{3} Hang?((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else λ (s: State): OK(s) endif))

(x′))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.2.2.

while_as_if_while.2:

{1} ∀ (b: bool):

b ⊃ (∀ (s: State):

(∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex′, body′, s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.2.

1281 C Proof scripts

while_as_if_while.3:

{1} ∀ (s: State):

(∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex′, body′, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_as_if_while.3. Q.E.D.

C.107.7 IterationStatements1.iterate_do_as_while

Terse proof for iterate_do_as_while.
iterate_do_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], n: nat): iterate_do(n, body, b_ex) = (body ## catch_continue ## iter- ate_while(n, b_ex, body))

Inducting on n on formula 1, we get 2 subgoals:

iterate_do_as_while.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): iterate_do(0, body, b_ex) = (body ## catch_continue ## iter- ate_while(0, b_ex, body))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, Applying decompose-equality, This completes the proof of iterate_do_as_while.1.

iterate_do_as_while.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]):

iterate_do(j, body, b_ex) = (body ## catch_continue ## iterate_while(j, b_ex, body)))

⊃ (∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtRe-

sult[State]]): iterate_do(j + 1, body, b_ex) = (body ## catch_continue ## iterate_while(j + 1, b_ex, body)))

Repeatedly Skolemizing and flattening, Expanding the definition of iterate_do, Expanding the definition of iterate_while, Applying decompose-equality, Instantiating quantified variables, Replacing using formula -2,

1282

C.107 Proofs for IterationStatements1 (statements.pvs)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_do_as_while.2. Q.E.D.

C.107.8 IterationStatements1.do_termination_point?_TCC1

Terse proof for do_termination_point?_TCC1.
do_termination_point?_TCC1:

{1} ∀ (body: [State → StmtResult[State]], b_ex: [State → ExprResult[State, bool]], s: State, n: nat, res: StmtResult[State]): OK?(res) ∧ res = iterate_do(n, body, b_ex)(s) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of do_termination_point?_TCC1.

Q.E.D.

C.107.9 IterationStatements1.termination_point_do_as_while_TCC1

Terse proof for termination_point_do_as_while_TCC1.
termination_point_do_as_while_TCC1:

{1} ∀ (body: [State → StmtResult[State]], s: State):

OK?((body ## catch_continue)(s)) ⊃ OK?[State]((##[State](body, catch_continue[State]))(s)) ∨ Break?[State]((##[State](body, catch_continue[State]))(s)) ∨ Continue?[State]((##[State](body, catch_continue[State]))(s)) ∨ Return?[State]((##[State](body, catch_continue[State]))(s)) ∨ Switch?[State]((##[State](body, catch_continue[State]))(s)) ∨ Default?[State]((##[State](body, catch_continue[State]))(s)) ∨ Exception?[State]((##[State](body, catch_continue[State]))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of termination_point_do_as_while_TCC1.

Q.E.D.

C.107.10 IterationStatements1.termination_point_do_as_while

Terse proof for termination_point_do_as_while.

1283 C Proof scripts

termination_point_do_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State): OK?((body ## catch_continue)(s)) ⊃ do_termination_point?(body, b_ex, s) = while_termination_point?(b_ex, body, state((body ## catch_continue)(s)))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of do_termination_point?, Expanding the definition of while_termination_point?, Rewriting using iterate_do_as_while, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of termination_point_do_as_while.

Q.E.D.

C.107.11 IterationStatements1.do_while_TCC1

Terse proof for do_while_TCC1.

do_while_TCC1:

{1} ∀ (body: [State → StmtResult[State]], b_ex: [State → ExprResult[State, bool]], s: State): (∃ (n: nat): do_termination_point?(body, b_ex, s)(n)) ⊃ nonempty?[nat](do_termination_point?(body, b_ex, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_while_TCC1. Q.E.D.

C.107.12 IterationStatements1.do_as_while

Terse proof for do_as_while.

do_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): do_while(body, b_ex) = (body ## catch_continue ## while(b_ex, body) ## catch_break)

Repeatedly Skolemizing and flattening, Expanding the definition of do_while, Expanding the definition of while, Applying decompose-equality, we get 3 subgoals:

1284

C.107 Proofs for IterationStatements1 (statements.pvs)

do_as_while.1:

{1} if ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n) then (iterate_do(min[nat](do_termination_point?(body′, b_ex′, x′)), body′, b_ex′) ## e2s(b_ex′) ## catch_break) (x′) else Hang endif = ((body′ ## catch_continue ## (λ (s: State): if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n) then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, s)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (s) else Hang endif)) ## catch_break) (x′)

Installing automatic rewrites from: (iterate_do_as_while! termination_point_do_as_while!) Case splitting on OK?((body!1 ## catch_continue)(x!1)), we get 2 subgoals:

do_as_while.1.1:

{-1} OK?((body′ ## catch_continue)(x′)) ; {1} if ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n) then (iterate_do(min[nat](do_termination_point?(body′, b_ex′, x′)), body′, b_ex′) ## e2s(b_ex′) ## catch_break) (x′) else Hang endif = ((body′ ## catch_continue ## (λ (s: State): if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n) then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, s)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (s) else Hang endif)) ## catch_break) (x′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.1.1.

1285 C Proof scripts

do_as_while.1.2:

{1} OK?((body′ ## catch_continue)(x′))

{2} if ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n)

then (iterate_do(min[nat](do_termination_point?(body′, b_ex′, x′)), body′, b_ex′) ## e2s(b_ex′) ## catch_break) (x′)

else Hang endif = ((body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break) (x′)

Trying repeated skolemization, instantiation, and if-lifting, we get 2 subgoals:

do_as_while.1.2.1:

{-1} Break?(body′(x′))
{1} ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n)

Instantiating the top quantifier in 1 with the terms: 0, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.1.2.1.

do_as_while.1.2.2:

{1} Continue?(body′(x′))
{2} OK?(body′(x′))
{3} ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n)
{4} Hang?(body′(x′))

Instantiating the top quantifier in 3 with the terms: 0, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.1.2.2.

do_as_while.2:

{1} ∀ (s: State):

(∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex′, body′, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.2.

1286

C.108 Proofs for IterationStatements2 (statements.pvs)

do_as_while.3:

{1} ∀ (s: State):

(∃ (n: nat): do_termination_point?(body′, b_ex′, s)(n)) ⊃ nonempty?[nat](do_termination_point?(body′, b_ex′, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.3. Q.E.D.

C.107.13 IterationStatements1.do_while_unroll

Terse proof for do_while_unroll.
do_while_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], max: nat): do_while(max, body, b_ex) = (body ## catch_continue ## while(max, b_ex, body) ## catch_break)

Repeatedly Skolemizing and flattening, Expanding the definition of do_while, Expanding the definition of while, Rewriting using do_as_while, matching in *, This completes the proof of do_while_unroll. Q.E.D.

C.108 Proofs for IterationStatements2 (statements.pvs)

C.108.1 IterationStatements2.iterate_for_TCC1

Terse proof for iterate_for_TCC1.
iterate_for_TCC1:

{1} ∀ (n: nat, s: State): ¬ n = 0 ⊃ n − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_for_TCC1. Q.E.D.

C.108.2 IterationStatements2.iterate_for_TCC2

Terse proof for iterate_for_TCC2.
iterate_for_TCC2:

{1} ∀ (n: nat, s: State): ¬ n = 0 ⊃ n − 1 < n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_for_TCC2. Q.E.D.

1287 C Proof scripts

C.108.3 IterationStatements2.iterate_for_as_while_TCC1

                                                                                                                 Terse proof for iterate_for_as_while_TCC1.
                                                                                                                   iterate_for_as_while_TCC1:

{1} ∀ (n: nat): n > 0 ⊃ n − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                   This completes the proof of iterate_for_as_while_TCC1.

Q.E.D.

C.108.4 IterationStatements2.iterate_for_as_while

                                                                                                                 Terse proof for iterate_for_as_while.
                                                                                                                   iterate_for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], n: nat): n > 0 ⊃ iterate_for(n, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(n − 1, expr ## b_ex, body)

## e2s(expr))

Inducting on n on formula 1,

we get 3 subgoals:

                                                                                                                   iterate_for_as_while.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): 0 > 0 ⊃ iterate_for(0, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(0 − 1, expr ## b_ex, body) ##

e2s(expr))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of iterate_for_as_while.1.

1288

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        iterate_for_as_while.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): j > 0 ⊃ iterate_for(j, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(j − 1, expr ## b_ex, body) ## e2s(expr)))

⊃

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): j + 1 > 0 ⊃ iterate_for(j + 1, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ##

iterate_while(j + 1 − 1, expr ## b_ex, body)

## e2s(expr)))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Applying decompose-equality,

Case splitting on j!1 = 0,

we get 2 subgoals:

                                                                                                                        iterate_for_as_while.2.1:

{-1} j′ = 0
{-2} j′ ≥ 0
{-3} j′ > 0 ⊃

iterate_for(j′, b_ex′, expr′, body′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′ − 1, expr′ ## b_ex′, body′) ## e2s(expr′))

{-4} 1 + j′ > 0

{1} iterate_for(1 + j′, b_ex′, expr′, body′)(x′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′, expr′ ## b_ex′, body′) ## e2s(expr′))

(x′)

Replacing using formula -1,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of iterate_for_as_while.2.1.

1289 C Proof scripts

                                                                                                                        iterate_for_as_while.2.2:

{-1} j′ ≥ 0
{-2} j′ > 0 ⊃

iterate_for(j′, b_ex′, expr′, body′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′ − 1, expr′ ## b_ex′, body′) ## e2s(expr′))

{-3} 1 + j′ > 0
{1} j′ = 0

{2} iterate_for(1 + j′, b_ex′, expr′, body′)(x′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′, expr′ ## b_ex′, body′) ## e2s(expr′))

(x′)

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of iterate_for, Expanding the definition of iterate_while, Replacing using formula -2, Keeping (2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of iterate_for_as_while.2.2.
                                                                                                                        iterate_for_as_while.3:

{1} ∀ (n: nat): n > 0 ⊃ n − 1 ≥ 0

{2} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): n′ > 0 ⊃ iterate_for(n′, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(n′ − 1, expr ## b_ex, body)

## e2s(expr))

Hiding formulas: 2,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_for_as_while.3. Q.E.D.

C.108.5 IterationStatements2.for_termination_point?_TCC1

                                                                                                                        Terse proof for for_termination_point?_TCC1.
                                                                                                                        for_termination_point?_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]],

expr: [State → ExprResult[State, ExprData]], body: [State → StmtResult[State]],

s: State, n: nat, res: StmtResult[State]): OK?(res) ∧ res = iterate_for(n, b_ex, expr, body)(s) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

1290

C.108 Proofs for IterationStatements2 (statements.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of for_termination_point?_TCC1.

Q.E.D.

C.108.6 IterationStatements2.termination_point_for_as_while_TCC1

                                                                                                                        Terse proof for termination_point_for_as_while_TCC1.
                                                                                                                        termination_point_for_as_while_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

s: State, n: nat): n > 0 ∧ OK?((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ OK?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Break?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Continue?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Return?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Switch?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Default?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Exception?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of termination_point_for_as_while_TCC1.

1291 C Proof scripts

Q.E.D.

C.108.7 IterationStatements2.termination_point_for_as_while

                                                                                                                        Terse proof for termination_point_for_as_while.
                                                                                                                        termination_point_for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State, n: nat): n > 0 ∧ OK?((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ for_termination_point?(b_ex, expr, body, s)(n) = while_termination_point?(expr ## b_ex, body, state((e2s(b_ex) ## body ## catch_continue)(s))) (n − 1)

Repeatedly Skolemizing and flattening,

Expanding the definition of for_termination_point?, Expanding the definition of while_termination_point?, Rewriting using iterate_for_as_while, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of termination_point_for_as_while.

Q.E.D.

C.108.8

IterationStatements2.min_termination_point_for_as_while_TCC1

                                                                                                                        Terse proof for min_termination_point_for_as_while_TCC1.
                                                                                                                        min_termination_point_for_as_while_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ nonempty?[nat](for_termination_point?(b_ex, expr, body, s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of min_termination_point_for_as_while_TCC1.

Q.E.D.

C.108.9

IterationStatements2.min_termination_point_for_as_while_TCC2

                                                                                                                        Terse proof for min_termination_point_for_as_while_TCC2.

1292

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        min_termination_point_for_as_while_TCC2:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], s: State): (¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ∧ (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)))

⊃

OK?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Break?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Continue?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Return?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Switch?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Default?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Exception?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of min_termination_point_for_as_while_TCC2.

Q.E.D.

1293 C Proof scripts

C.108.10

IterationStatements2.min_termination_point_for_as_while_TCC3

                                                                                                                        Terse proof for min_termination_point_for_as_while_TCC3.
                                                                                                                        min_termination_point_for_as_while_TCC3:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ∧ (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n))) ⊃ nonempty?[nat] (while_termination_point?[State] (##[State, ExprData, boolean](expr, b_ex), body, state[State] ((##[State] (##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Case splitting on n!1 = 0,

we get 2 subgoals:

                                                                                                                        min_termination_point_for_as_while_TCC3.1:

{-1} n′ = 0
{-2} n′ ≥ 0
{-3} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))
{-4} for_termination_point?(b_ex′, expr′, body′, s′)(n′)
{1} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{2} nonempty?[nat]

(while_termination_point?[State]

(##[State, ExprData, boolean](expr′, b_ex′), body′,

state[State]

((##[State]

(##[State](e2s[State, boolean](b_ex′), body′),

catch_continue[State])) (s′))))

Rewriting using min_def, matching in *,

Expanding the definition of minimum?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of min_termination_point_for_as_while_TCC3.1.

1294

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        min_termination_point_for_as_while_TCC3.2:

{-1} n′ ≥ 0
{-2} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))
{-3} for_termination_point?(b_ex′, expr′, body′, s′)(n′)
{1} n′ = 0
{2} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{3} nonempty?[nat]

(while_termination_point?[State]

(##[State, ExprData, boolean](expr′, b_ex′), body′,

state[State]

((##[State]

(##[State](e2s[State, boolean](b_ex′), body′),

catch_continue[State])) (s′))))

Rewriting using termination_point_for_as_while, matching in *,

Hiding formulas: 2,

Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of min_termination_point_for_as_while_TCC3.2.

Q.E.D.

C.108.11 IterationStatements2.min_termination_point_for_as_while

                                                                                                                        Terse proof for min_termination_point_for_as_while.
                                                                                                                        min_termination_point_for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ∧ ¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ⊃ min[nat](for_termination_point?(b_ex, expr, body, s)) = min [nat](while_termination_point? (expr ## b_ex, body, state [State]((e2s(b_ex) ## body ## catch_continue)(s)))) + 1

Skolemizing (with typepred on new Skolem constants), Applying disjunctive simplification to flatten sequent, Case splitting on while_termination_point?(expr!1 ## b_ex!1, body!1, state((e2s(b_ex!1) ## body!1 ## catch_continue) (s!1))) = (LAMBDA (n: nat): for_termination_point?(b_ex!1, expr!1, body!1, s!1)(n + 1)),

we get 2 subgoals:

1295 C Proof scripts

                                                                                                                        min_termination_point_for_as_while.1:

{-1} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)(s′)))

= (λ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n + 1))

{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n)
{-3} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))
{1} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{2} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(s′)))) + 1

Replacing using formula -1, Keeping (-2 1 2) and hiding *, Using lemma min_plus1, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 2, Rewriting using min_def, matching in *, Expanding the definition of minimum?, which is trivially true.

                                                                                                                        This completes the proof of min_termination_point_for_as_while.1.
                                                                                                                        min_termination_point_for_as_while.2:

{-1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n)
{-2} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))

{1} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)(s′)))

= (λ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n + 1))

{2} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{3} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(s′)))) + 1

Hiding formulas: 3,

Applying decompose-equality,

Rewriting using termination_point_for_as_while, matching in *,

                                                                                                                        This completes the proof of min_termination_point_for_as_while.2.

Q.E.D.

C.108.12

IterationStatements2.nonzero_min_for_termination_point_TCC1

                                                                                                                        Terse proof for nonzero_min_for_termination_point_TCC1.
                                                                                                                        nonzero_min_for_termination_point_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ⊃ nonempty?[nat](for_termination_point?(b_ex, expr, body, s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of nonzero_min_for_termination_point_TCC1.

Q.E.D.

1296

C.108 Proofs for IterationStatements2 (statements.pvs)

C.108.13 IterationStatements2.nonzero_min_for_termination_point

                                                                                                                        Terse proof for nonzero_min_for_termination_point.
                                                                                                                        nonzero_min_for_termination_point:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ∧ ¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ⊃ OK?(b_ex(s)) ∧ data(b_ex(s))

Repeatedly Skolemizing and flattening,

Rewriting using min_def, matching in *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of nonzero_min_for_termination_point.

Q.E.D.

C.108.14 IterationStatements2.for_as_while

Terse proof for for_as_while.

                                                                                                                        for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], init: [State → StmtResult[State]]):

for(init, b_ex, expr, body) = (init ##

if_else(b_ex, body ## catch_continue ## while(expr ## b_ex, body) ## catch_break, skip))

Installing automatic rewrites from: for while comp_eval_if_ok_fstmt_single lift skip

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Expanding the definition of if_else,

Expanding the definition of while,

Expanding the definition of ##,

Case splitting on OK?(init!1(x!1)),

we get 2 subgoals:

1297 C Proof scripts

                                                                                                                        for_as_while.1:

{-1} OK?(init′(x′))

{1} lift(λ (state: State):

if ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state)(n)

then (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state)), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state)

else Hang endif)

(init′(x′)) = lift((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′)

## catch_break)

(s)

else Hang endif)) ## catch_break

else skip endif)))

(init′(x′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

1298

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.1:

{-1} OK?(init′(x′))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{1} (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′)

## catch_break)

(s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Case splitting on min(for_termination_point?(b_ex!1, expr!1, body!1, state(init!1(x!1)))) = 0,

we get 2 subgoals:

1299 C Proof scripts

                                                                                                                        for_as_while.1.1.1:

{-1} min(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))) = 0
{-2} OK?(init′(x′))
{-3} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{1} (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′)

## catch_break)

(s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Replacing using formula -1,

Expanding the definition of iterate_for,

Rewriting using min_def, matching in *,

Hiding formulas: -3,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.1.

1300

C.108 Proofs for IterationStatements2 (statements.pvs)

for_as_while.1.1.2:

{-1} OK?(init′(x′))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{1} min(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))) = 0

{2} (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state(init′(x′)))

= (b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif))

(state(init′(x′)))

Using lemma nonzero_min_for_termination_point,

Rewriting using iterate_for_as_while, matching in *,

Rewriting using min_termination_point_for_as_while, matching in *,

we get 2 subgoals:

1301 C Proof scripts

for_as_while.1.1.2.1:

{-1} (∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)) ∧ ¬ 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 ⊃ OK?(b_ex′(state(init′(x′)))) ∧ data(b_ex′(state(init′(x′))))

{-2} OK?(init′(x′))
{-3} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′)))))) − 1,

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

= (b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif))

(state(init′(x′)))

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of lift,

Rewriting using comp_simple_stmt_simple_expr, matching in *,

Case splitting on OK?((body!1 ## catch_continue)(state((init!1 ## b_ex!1)(x!1)))),

we get 2 subgoals:

1302

C.108 Proofs for IterationStatements2 (statements.pvs)

for_as_while.1.1.2.1.1:

{-1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-3} OK?((init′ ## b_ex′)(x′))
{-4} data((init′ ## b_ex′)(x′))
{-5} OK?(init′(x′))

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

= catch_break(cases (body′ ## catch_continue)(state((init′ ## b_ex′)(x′))) of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (state_1)

else Hang endif

else (body′ ## catch_continue)(state((init′ ## b_ex′)(x′))) endcases)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

1303 C Proof scripts

for_as_while.1.1.2.1.1.1:

{-1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-3} OK?((init′ ## b_ex′)(x′))
{-4} data((init′ ## b_ex′)(x′))
{-5} OK?(init′(x′))

{-6} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

= catch_break((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state ((body′ ## catch_continue)

(state

((init′ ## b_ex′)

(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′))))))

Keeping (-1 -3 -5 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.1.

1304

C.108 Proofs for IterationStatements2 (statements.pvs)

for_as_while.1.1.2.1.1.2:

{-1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-3} OK?((init′ ## b_ex′)(x′))
{-4} data((init′ ## b_ex′)(x′))
{-5} OK?(init′(x′))

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

{3} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

= catch_break(Hang)

Hiding formulas: 3, Repeatedly Skolemizing and flattening, Case splitting on n!1 = 0, we get 2 subgoals:

for_as_while.1.1.2.1.1.2.1:

{-1} n′ = 0
{-2} n′ ≥ 0
{-3} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-4} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-5} OK?((init′ ## b_ex′)(x′))
{-6} data((init′ ## b_ex′)(x′))
{-7} OK?(init′(x′))

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

Replacing using formula -1, Expanding the definition of for_termination_point?, Expanding the definition of iterate_for, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.1.

1305 C Proof scripts

for_as_while.1.1.2.1.1.2.2:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ = 0

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

Instantiating the top quantifier in 3 with the terms: n′ − 1, we get 2 subgoals:

for_as_while.1.1.2.1.1.2.2.1:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ = 0

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n′ − 1)

Rewriting using termination_point_for_as_while, matching in *, we get 2 subgoals:

for_as_while.1.1.2.1.1.2.2.1.1:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))

{-3} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))

(n′ − 1)

{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ = 0

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n′ − 1)

1306

C.108 Proofs for IterationStatements2 (statements.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.2.1.1.

for_as_while.1.1.2.1.1.2.2.1.2:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} OK?((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))
{2} n′ = 0

{3} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {4} while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n′ − 1)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.2.1.2.

for_as_while.1.1.2.1.1.2.2.2:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ − 1 ≥ 0
{2} n′ = 0

{3} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′)))))) = 0

Keeping (-1 1 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.2.2.

1307 C Proof scripts

                                                                                                                   for_as_while.1.1.2.1.2:

{-1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-2} OK?((init′ ## b_ex′)(x′))
{-3} data((init′ ## b_ex′)(x′))
{-4} OK?(init′(x′))
{1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

catch_break(cases (body′ ## catch_continue)(state((init′ ## b_ex′)(x′))) of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′)

## catch_break)

(state_1)

else Hang endif

else (body′ ## catch_continue)(state((init′ ## b_ex′)(x′)))

endcases)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.2.

1308

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.1.2.2:

{-1} (∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n))

⊃ OK?(b_ex′(state(init′(x′)))) ∧ data(b_ex′(state(init′(x′))))

{-2} OK?(init′(x′))
{-3} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{1} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))
{2} min(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))) = 0

{3} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min [nat](for_termination_point? (b_ex′, expr′, body′, state(init′(x′)))) − 1,

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.2.

1309 C Proof scripts

                                                                                                                        for_as_while.1.2:

{-1} OK?(init′(x′))
{1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{2} Hang?((b_ex′ ##
(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′)

## catch_break)

(s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′))))

Copying formula number: 1

Copying formula number: 1

Instantiating the top quantifier in 1 with the terms: 0,

Instantiating the top quantifier in 2 with the terms: 1,

Expanding the definition of for_termination_point?,

Expanding the definition of iterate_for,

Expanding the definition of iterate_for,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of ##,

Expanding the definition of catch_break,

Expanding the definition of lift,

Expanding the definition of e2s,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of catch_continue,

Simplifying, rewriting, and recording with decision procedures,

Case splitting on OK?(body!1(state(b_ex!1(state(init!1(x!1)))))) OR Continue?(body!1(state(b_ex!1(state(init!1(x!1)))))),

we get 2 subgoals:

1310

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.2.1:

{-1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-2} OK?(OK(state(init′(x′))))
{-3} OK?(b_ex′(state(init′(x′))))
{-4} data(b_ex′(state(init′(x′))))
{-5} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-6} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

##

(λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

##

(λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} OK?(init′(x′))
{1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{2} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

##

(λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

##

(λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

##

(λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

##

(λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1311 C Proof scripts

Case splitting on EXISTS (n: nat): while_termination_point?(expr!1 ## b_ex!1, body!1, state(body!1 (state(b_ex!1(state(init!1(x!1))))))) (n),

we get 3 subgoals:

1312

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.2.1.1:

{-1} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n)

{-2} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-3} OK?(OK(state(init′(x′))))
{-4} OK?(b_ex′(state(init′(x′))))
{-5} data(b_ex′(state(init′(x′))))
{-6} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-7} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

##

(λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

##

(λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-9} OK?(init′(x′))
{1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{2} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

##

(λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

##

(λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

##

(λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

##

(λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1313 C Proof scripts

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Instantiating the top quantifier in 1 with the terms: n′ + 1,

Rewriting using termination_point_for_as_while, matching in *,

we get 2 subgoals:

1314

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.2.1.1.1:

{-1} n′ ≥ 0

{-2} while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n′)

{-3} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-4} OK?(OK(state(init′(x′))))
{-5} OK?(b_ex′(state(init′(x′))))
{-6} data(b_ex′(state(init′(x′))))
{-7} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-8} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-9} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-10} OK?(init′(x′))

{1} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))

(n′)

1315 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.2.1.1.1.

1316

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.2.1.1.2:

{-1} n′ ≥ 0

{-2} while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n′)

{-3} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-4} OK?(OK(state(init′(x′))))
{-5} OK?(b_ex′(state(init′(x′))))
{-6} data(b_ex′(state(init′(x′))))
{-7} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-8} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-9} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-10} OK?(init′(x′))
{1} OK?((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))
{2} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(1 + n′)

1317 C Proof scripts

Hiding formulas: (-2 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.2.1.1.2.

1318

C.108 Proofs for IterationStatements2 (statements.pvs)

                                                                                                                        for_as_while.1.2.1.2:

{-1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-2} OK?(OK(state(init′(x′))))
{-3} OK?(b_ex′(state(init′(x′))))
{-4} data(b_ex′(state(init′(x′))))
{-5} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-6} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

##

(λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′

##

(λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

##

(λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} OK?(init′(x′))
{1} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n)

{2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{3} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

##

(λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

##

(λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

##

(λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

##

(λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1319 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.1.2.1.2.

1320

C.108 Proofs for IterationStatements2 (statements.pvs)

for_as_while.1.2.1.3:

{-1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-2} OK?(OK(state(init′(x′))))
{-3} OK?(b_ex′(state(init′(x′))))
{-4} data(b_ex′(state(init′(x′))))

{-5} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-6} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} OK?(init′(x′))

{1} OK?[State](body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Break?[State](body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Continue?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Return?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Switch?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Default?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Exception?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′))))))

{2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{3} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1321 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.1.2.1.3.

1322

C.108 Proofs for IterationStatements2 (statements.pvs)

for_as_while.1.2.2:

{-1} OK?(OK(state(init′(x′))))
{-2} OK?(b_ex′(state(init′(x′))))
{-3} data(b_ex′(state(init′(x′))))

{-4} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-5} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-6} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} OK?(init′(x′))

{1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{3} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1323 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.2.2.

for_as_while.2:

{1} OK?(init′(x′))

{2} lift(λ (state: State):

if ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state)(n)

then (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state)), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state)

else Hang endif)

(init′(x′)) = lift((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif)))

(init′(x′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.2.

Q.E.D.

C.108.15 IterationStatements2.for_unroll

Terse proof for for_unroll.

1324

C.109 Proofs for IterationStatements3 (statements.pvs)

for_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], init: [State → StmtResult[State]],

max: nat): for(max, init, b_ex, expr, body) = (init ##

if_else(b_ex, body ## catch_continue ## while(max, expr ## b_ex, body) ## catch_break, skip))

Repeatedly Skolemizing and flattening, Expanding the definition of for, Expanding the definition of while, Rewriting using for_as_while, matching in *, This completes the proof of for_unroll. Q.E.D.

C.109 Proofs for IterationStatements3 (statements.pvs)

C.109.1 IterationStatements3.do_while_inv_unroll

Terse proof for do_while_inv_unroll.
do_while_inv_unroll:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

variant: [State → [State → Ord]]): do_while(body, b_ex)(P, Q, R, variant, <) = (body ## catch_continue ## while(b_ex, body)(P, Q, R, vari-

ant, <) ## catch_break)

Repeatedly Skolemizing and flattening, Expanding the definition of do_while, Expanding the definition of while, Rewriting using do_as_while, matching in *, This completes the proof of do_while_inv_unroll. Q.E.D.

C.110 Proofs for IterationStatements4 (statements.pvs)

C.110.1 IterationStatements4.for_inv_unroll

Terse proof for for_inv_unroll.

1325 C Proof scripts

for_inv_unroll:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], init: [State → StmtResult[State]],

variant: [State → [State → Ord]]): for(init, b_ex, expr, body)(P, Q, R, variant, <) = (init ##

if_else(b_ex,

body ## catch_continue ## while(expr ## b_ex, body)(P, Q, R, vari-

ant, <) ## catch_break, skip))

Repeatedly Skolemizing and flattening, Expanding the definition of for, Expanding the definition of while, Rewriting using for_as_while, matching in *, This completes the proof of for_inv_unroll. Q.E.D.

C.111 Proofs for JumpStatements1 (statements.pvs)

This theory contains no provable formal statements.

C.112 Proofs for JumpStatements2 (statements.pvs)

This theory contains no provable formal statements.

C.113 Proofs for LabeledStatements (statements.pvs)

This theory contains no provable formal statements.

C.114 Proofs for Linear_Memory (linear_memory.pvs)

C.114.1 Linear_Memory.xlat_idx_TCC1

Terse proof for xlat_idx_TCC1.

xlat_idx_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): offset(addr) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of xlat_idx_TCC1. Q.E.D.

1326

C.114 Proofs for Linear_Memory (linear_memory.pvs)

C.114.2 Linear_Memory.xlat_idx_TCC2

Terse proof for xlat_idx_TCC2.

xlat_idx_TCC2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): bus_width− (lvl + 1) × bits_per_level≥ 0

Trying repeated skolemization, instantiation, and if-lifting, Using lemma bus_width, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of xlat_idx_TCC2. Q.E.D.

C.114.3 Linear_Memory.xlat_idx_pe_aligned_TCC1

Terse proof for xlat_idx_pe_aligned_TCC1.
xlat_idx_pe_aligned_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): offset(base) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_idx_pe_aligned_TCC1.

Q.E.D.

C.114.4 Linear_Memory.xlat_idx_pe_aligned_TCC2

Terse proof for xlat_idx_pe_aligned_TCC2.
xlat_idx_pe_aligned_TCC2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bits_per_level + pe_size)(offset(base)) ⊃

offset(xlat_idx(lvl, base, addr)) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_idx_pe_aligned_TCC2.

Q.E.D.

C.114.5 Linear_Memory.xlat_idx_pe_aligned

Terse proof for xlat_idx_pe_aligned.
xlat_idx_pe_aligned:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bits_per_level + pe_size)(offset(base)) ⊃

aligned?(pe_size)(offset(xlat_idx(lvl, base, addr)))

Repeatedly Skolemizing and flattening, Expanding the definition of xlat_idx, Installing automatic rewrites from: (bus_width! bits_per_level! max_level!) Case splitting on -1 * (bits_per_level * lvl!1) - bits_per_level + bus_width >= 0, we get 2 subgoals:

1327 C Proof scripts

                                                                                                                   xlat_idx_pe_aligned.1:

{-1} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Using lemma aligned_shift_bits_ok,

we get 2 subgoals:

                                                                                                                   xlat_idx_pe_aligned.1.1:

{-1} pe_size ≤ pe_size ⊃ aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Expanding the definition of +,

Using lemma aligned_plus,

we get 4 subgoals:

1328

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        xlat_idx_pe_aligned.1.1.1:

{-1} aligned?(min(bits_per_level + pe_size, pe_size))

(offset(base′) + shift_bits_left (cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level ), pe_size))

{-2} pe_size ≤ pe_size ⊃ aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-3} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-4} lvl′ < max_level
{-5} Mem?(base′`type_of)
{-6} 0 ≤ base′`offset
{-7} base′`offset < max_linear_offset
{-8} Mem?(addr′`type_of)
{-9} 0 ≤ addr′`offset
{-10} addr′`offset < max_linear_offset
{-11} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size) (base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Expanding the definition of min,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_idx_pe_aligned.1.1.1.
                                                                                                                        xlat_idx_pe_aligned.1.1.2:

{-1} pe_size ≤ pe_size ⊃ aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), 22 − 10 × lvl′, 10), pe_size))

{2} aligned?(pe_size) (base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_idx_pe_aligned.1.1.2.

1329 C Proof scripts

                                                                                                                        xlat_idx_pe_aligned.1.1.3:

{-1} pe_size ≤ pe_size ⊃ aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{1} 22 − 10 × lvl′ ≥ 0

{2} aligned?(pe_size)

(base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_idx_pe_aligned.1.1.3.
                                                                                                                        xlat_idx_pe_aligned.1.1.4:

{-1} pe_size ≤ pe_size ⊃ aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{1} aligned?(10 + pe_size)(offset(base′))

{2} aligned?(pe_size)

(base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_idx_pe_aligned.1.1.4.

1330

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        xlat_idx_pe_aligned.1.2:

{-1} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))
{1} 22 − 10 × lvl′ ≥ 0

{2} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_pe_aligned.1.2.

                                                                                                                        xlat_idx_pe_aligned.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))
{1} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0

{2} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_pe_aligned.2.

Q.E.D.

C.114.6 Linear_Memory.xlat_idx_memory_address

                                                                                                                        Terse proof for xlat_idx_memory_address.
                                                                                                                        xlat_idx_memory_address:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bits_per_level + pe_size)(offset(base)) ⊃ xlat_idx(lvl, base, addr) < max_linear

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: Mem + < max_linear max_linear_offset bits_per_level pe_size max_level bus_width

Expanding the definition of xlat_idx,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma aligned_add_below,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using shift_bits_left_less, matching in *,

1331 C Proof scripts

This completes the proof of xlat_idx_memory_address.

Q.E.D.

C.114.7 Linear_Memory.xlat_idx_memory_address2

                                                                                                                        Terse proof for xlat_idx_memory_address2.
                                                                                                                        xlat_idx_memory_address2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bits_per_level + pe_size)(offset(base)) ⊃ 0 ≤ offset(xlat_idx(lvl, base, addr))

Expanding the definition of xlat_idx, Repeatedly Skolemizing and flattening, Adding type constraints for shift_bits_left(cut_bits(offset(addr!1), -1 * (lvl!1 * bits_per_level) -

bits_per_level + bus_width, bits_per_level), pe_size), we get 2 subgoals:

                                                                                                                        xlat_idx_memory_address2.1:

{-1} shift_bits_left(cut_bits(offset(addr′), −1 × (lvl′ × bits_per_level ) − bits_per_level + bus_width, bits_per_level),

pe_size)

≥ 0

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))
{1} 0 ≤

offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × lvl′ × bits_per_level − bits_per_level + bus_width, bits_per_level ), pe_size))

Expanding the definition of +,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_idx_memory_address2.1.
                                                                                                                        xlat_idx_memory_address2.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))
{1} −1 × (lvl′ × bits_per_level ) − bits_per_level + bus_width≥ 0
{2} 0 ≤

offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × lvl′ × bits_per_level − bits_per_level + bus_width, bits_per_level ), pe_size))

1332

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Keeping (-1 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

Expanding the definition of bus_width,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_idx_memory_address2.2.

Q.E.D.

C.114.8 Linear_Memory.xlat_ofs_memory_address

                                                                                                                        Terse proof for xlat_ofs_memory_address.
                                                                                                                        xlat_ofs_memory_address:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bus_width− (lvl + 1) × bits_per_level )(offset(base)) ⊃ xlat_ofs(lvl, base, addr) < max_linear

Installing automatic rewrites from: Mem + < max_linear max_linear_offset bits_per_level pe_size max_level bus_width

Repeatedly Skolemizing and flattening,

Expanding the definition of xlat_ofs,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma aligned_add_below,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_memory_address.

Q.E.D.

C.114.9 Linear_Memory.xlat_ofs_memory_address2

                                                                                                                        Terse proof for xlat_ofs_memory_address2.
                                                                                                                        xlat_ofs_memory_address2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bus_width− (lvl + 1) × bits_per_level )(offset(base)) ⊃ 0 ≤ offset(xlat_ofs(lvl, base, addr))

Expanding the definition of xlat_ofs,

Expanding the definition of +,

Repeatedly Skolemizing and flattening,

Using lemma cut_bits_below,

we get 2 subgoals:

1333 C Proof scripts

                                                                                                                        xlat_ofs_memory_address2.1:

{-1} cut_bits(offset(addr′), 0,

−1 × lvl′ × bits_per_level − bits_per_level + bus_width)

< expt(2, −1 × lvl′ × bits_per_level − bits_per_level + bus_width)

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset

{-9} aligned?(−1 × lvl′ × bits_per_level − bits_per_level + bus_width)

(offset(base′))

{1} 0 ≤ base′‘offset + cut_bits(offset(addr′), 0, −1 × lvl′ × bits_per_level − bits_per_level + bus_width)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_ofs_memory_address2.1.
                                                                                                                        xlat_ofs_memory_address2.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset

{-8} aligned?(−1 × lvl′ × bits_per_level − bits_per_level + bus_width)

(offset(base′))

{1} −1 × lvl′ × bits_per_level − bits_per_level + bus_width≥ 0
{2} 0 ≤

base′‘offset + cut_bits(offset(addr′), 0, −1 × lvl′ × bits_per_level − bits_per_level + bus_width)

Keeping (-1 1) and hiding *,

Installing automatic rewrites from: bus_width

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of xlat_ofs_memory_address2.2.

Q.E.D.

C.114.10 Linear_Memory.raise_fault_TCC1

                                                                                                                        Terse proof for raise_fault_TCC1.
                                                                                                                        raise_fault_TCC1:

{1} ∀ (access: Memory_access, pfa: Memory_Address_4G):

(Read ∈ (singleton[Memory_access](access) ∪ {Read}))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of raise_fault_TCC1.

Q.E.D.

1334

C.114 Proofs for Linear_Memory (linear_memory.pvs)

C.114.11 Linear_Memory.translate_TCC1

                                                                                                                        Terse proof for translate_TCC1.
                                                                                                                        translate_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

pe_addr: Address): pe_addr = xlat_idx(lvl, base, addr) ⊃ (∀ (pe: (range_pt(lvl))):

accessible?(pe, access) ∧ privileged?(pe, priv) ∧ present?(pe) ∧ paging_type?(lvl, pe) ⊃ range_pt(lvl)(set_reference(pe, access)))

Repeatedly Skolemizing and flattening,

Rewriting using set_reference_range, matching in *,

This completes the proof of translate_TCC1.

Q.E.D.

C.114.12 Linear_Memory.translate_memory_address

                                                                                                                        Terse proof for translate_memory_address.
                                                                                                                        translate_memory_address:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ⊃ data(translate(lvl, base, addr, access, priv)(s))`2 < max_linear

Expanding the definition of translate,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: ( ##! <! ok_result! exception_result! fatal_result! raise_fault! max_linear! Mem!)

Case splitting on OK?(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1)) AND present?(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

1335 C Proof scripts

                                                                                                                        translate_memory_address.1:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2

< max_linear

Adding type constraints for base(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

1336

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        translate_memory_address.1.1:

{-1} Mem?(base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) (s′)))`type_of)

{-2} 0 ≤

base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

{-3} base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

< max_linear_offset {-4} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} Mem?(addr′`type_of)
{-10} 0 ≤ addr′`offset
{-11} addr′`offset < max_linear_offset
{-12} aligned?(bits_per_level + pe_size)(offset(base′))

{-13} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))`2

< max_linear

1337 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of translate_memory_address.1.1.
                                                                                                                        translate_memory_address.1.2:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} present?(data[Physical_memory, ((range_pt(lvl′)))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) (s′)))

{2} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2

< max_linear

Simplifying, rewriting, and recording with decision procedures,

1338

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        This completes the proof of translate_memory_address.1.2.
                                                                                                                        translate_memory_address.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))

{-9} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{2} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2

< max_linear

Hiding formulas: 2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of translate_memory_address.2.

Q.E.D.

1339 C Proof scripts

C.114.13 Linear_Memory.translate_memory_address2

                                                                                                                        Terse proof for translate_memory_address2.

                                                                                                                        translate_memory_address2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ⊃ 0 ≤ offset(data(translate(lvl, base, addr, access, priv)(s))`2)

Expanding the definition of translate,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: ( ##! <! ok_result! exception_result! fatal_result! raise_fault! max_linear! Mem!)

Case splitting on OK?(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1)) AND present?(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

1340

C.114 Proofs for Linear_Memory (linear_memory.pvs)

translate_memory_address2.1:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))

{1} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))`2)

Adding type constraints for base(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

1341 C Proof scripts

translate_memory_address2.1.1:

{-1} Mem?(base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`type_of)

{-2} 0 ≤

base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

{-3} base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

< max_linear_offset {-4} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} Mem?(addr′`type_of)
{-10} 0 ≤ addr′`offset
{-11} addr′`offset < max_linear_offset
{-12} aligned?(bits_per_level + pe_size)(offset(base′))

{-13} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))

{1} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))`2)

1342

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_memory_address2.1.1.

1343 C Proof scripts

translate_memory_address2.1.2:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))

{1} present?(data[Physical_memory, ((range_pt(lvl′)))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) (s′)))

{2} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))`2)

Simplifying, rewriting, and recording with decision procedures,

1344

C.114 Proofs for Linear_Memory (linear_memory.pvs)

This completes the proof of translate_memory_address2.1.2.
translate_memory_address2.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))

{-9} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))

{1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{2} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe)

then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif

else fatal_result endif))

(s′))`2)

Hiding formulas: 2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_memory_address2.2.

Q.E.D.

1345 C Proof scripts

C.114.14 Linear_Memory.translate_result_leaf_TCC1

Terse proof for translate_result_leaf_TCC1.
translate_result_leaf_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ offset

(data[Physical_memory, [bool, Address]]

(translate(lvl, base, addr, access, priv)(s))`2) ≥ 0

Repeatedly Skolemizing and flattening, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_leaf_TCC1.

Q.E.D.

C.114.15 Linear_Memory.translate_result_leaf_TCC2

Terse proof for translate_result_leaf_TCC2.
translate_result_leaf_TCC2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ bus_width− bits_per_level × (lvl + 1) ≥ 0

Repeatedly Skolemizing and flattening, Keeping (-1 1) and hiding *, Installing automatic rewrites from: bus_width Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_result_leaf_TCC2.

Q.E.D.

C.114.16 Linear_Memory.translate_result_leaf

Terse proof for translate_result_leaf.

1346

C.114 Proofs for Linear_Memory (linear_memory.pvs)

translate_result_leaf:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ aligned?(bus_width− bits_per_level × (lvl + 1))

(offset(data(translate(lvl, base, addr, access, priv)(s))`2))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Installing automatic rewrites from: ( ##! ok_result! exception_result! fatal_result! raise_fault!

is_leaf?! bus_width! pe_size! bits_per_level! base! paging_tape?! pdir_entry?! ptab_entry?! max_level!) Expanding the definition of paging_type?, Expanding the definition of pdir_entry?, Expanding the definition of ptab_entry?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of translate_result_leaf. Q.E.D.

C.114.17 Linear_Memory.translate_result_no_leaf_TCC1

Terse proof for translate_result_no_leaf_TCC1.
translate_result_no_leaf_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ ¬ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ offset

(data[Physical_memory, [bool, Address]]

(translate(lvl, base, addr, access, priv)(s))`2) ≥ 0

Repeatedly Skolemizing and flattening, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_no_leaf_TCC1.

Q.E.D.

C.114.18 Linear_Memory.translate_result_no_leaf

Terse proof for translate_result_no_leaf.

1347 C Proof scripts

                                                                                                                   translate_result_no_leaf:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ ¬ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ aligned?(bits_per_level + pe_size)

(offset(data(translate(lvl, base, addr, access, priv)(s))`2))

Repeatedly Skolemizing and flattening,

Expanding the definition of translate,

Installing automatic rewrites from: ( ##! ok_result! exception_result! fatal_result! raise_fault! is_leaf?! bus_width! pe_size! bits_per_level! base! paging_tape?! pdir_entry?! ptab_entry?! max_level!)

Expanding the definition of paging_type?,

Expanding the definition of pdir_entry?,

Expanding the definition of ptab_entry?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                   This completes the proof of translate_result_no_leaf.

Q.E.D.

C.114.19 Linear_Memory.linear_resolve_TCC1

                                                                                                                 Terse proof for linear_resolve_TCC1.
                                                                                                                   linear_resolve_TCC1:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ lvl < max_level)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_TCC1.

Q.E.D.

C.114.20 Linear_Memory.linear_resolve_TCC2

                                                                                                                 Terse proof for linear_resolve_TCC2.

1348

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        linear_resolve_TCC2:

{1} ∀ (addr: Memory_Address_4G, access: Memory_access, cs: Segment_Reg_type,

priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat):

lvl = pdir_lvl ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(−1 × lvl × bits_per_level − bits_per_level + bus_width)

(offset(t`2)) else aligned?(bits_per_level + pe_size)(offset(t`2)) endif)

(translate(lvl, pdbr`base_addr, addr, access, priv)(x_{1}))))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Using lemma translate_memory_address, Using lemma translate_memory_address2, Installing automatic rewrites from: max_linear Mem < bits_per_level pe_size Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_resolve_TCC2. Q.E.D.

C.114.21 Linear_Memory.linear_resolve_TCC3

                                                                                                                        Terse proof for linear_resolve_TCC3.
                                                                                                                        linear_resolve_TCC3:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, b: Memory_Address_4G): leaf ⊃ off- set(b) ≥ 0))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: bus_width bits_per_level max_level

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_TCC3.

Q.E.D.

C.114.22 Linear_Memory.linear_resolve_TCC4

                                                                                                                        Terse proof for linear_resolve_TCC4.

1349 C Proof scripts

                                                                                                                        linear_resolve_TCC4:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, b: Memory_Address_4G): leaf ⊃ bus_width− bits_per_level × (lvl + 1) ≥ 0))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: bus_width bits_per_level max_level pdir_lvl

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_TCC4.

Q.E.D.

C.114.23 Linear_Memory.linear_resolve_TCC5

                                                                                                                        Terse proof for linear_resolve_TCC5.
                                                                                                                        linear_resolve_TCC5:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, b: Memory_Address_4G): ¬ leaf ⊃ offset(b) ≥ 0))

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_TCC5.

Q.E.D.

C.114.24 Linear_Memory.linear_resolve_TCC6

                                                                                                                        Terse proof for linear_resolve_TCC6.
                                                                                                                        linear_resolve_TCC6:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, base: {b: Memory_Address_4G | if leaf then aligned?(bus_width− bits_per_level × (lvl + 1)) (offset(b)) else aligned?(bits_per_level + pe_size)(offset(b)) endif}): ¬ leaf ⊃ (∀ (lvl1: nat): lvl1 = ptab_lvl ⊃ lvl1 < max_level)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_TCC6.

1350

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Q.E.D.

C.114.25 Linear_Memory.linear_resolve_TCC7

                                                                                                                        Terse proof for linear_resolve_TCC7.
                                                                                                                        linear_resolve_TCC7:

{1} ∀ (addr: Memory_Address_4G, access: Memory_access, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, base: {b: Memory_Address_4G | if leaf then aligned?(bus_width− bits_per_level × (lvl + 1)) (offset(b)) else aligned?(bits_per_level + pe_size)(offset(b)) endif}): ¬ leaf ⊃ (∀ (lvl1: nat): lvl1 = ptab_lvl ⊃ (∀ (x_{1}: Physical_memory): every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true, λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate(lvl1, base, addr, access, priv)(x_{1}))))))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Using lemma translate_memory_address, Using lemma translate_memory_address2, Installing automatic rewrites from: max_linear Mem < bits_per_level pe_size Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_resolve_TCC7. Q.E.D.

C.114.26 Linear_Memory.linear_resolve_TCC8

                                                                                                                        Terse proof for linear_resolve_TCC8.

1351 C Proof scripts

                                                                                                                        linear_resolve_TCC8:

{1} ∀ (leaf: bool, addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Mem-

ory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat):

lvl = pdir_lvl ⊃

(∀ (b: Memory_Address_4G):

leaf ⊃

−1 × lvl × bits_per_level − bits_per_level + bus_width≥ 0))

Repeatedly Skolemizing and flattening,

Keeping (-9 1) and hiding *,

Installing automatic rewrites from: bus_width

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_TCC8.

Q.E.D.

C.114.27 Linear_Memory.linear_resolve_memory_address

                                                                                                                        Terse proof for linear_resolve_memory_address.
                                                                                                                        linear_resolve_memory_address:

{1} ∀ (access: Memory_access, addr: Memory_Address_4G, x_{1}: Linear_memory):

every[Linear_memory, Address]

(λ (x: Linear_memory): true,

λ (x: Address):

Mem?(x`type_of) ∧ 0 ≤ x`offset ∧ x`offset < max_linear_offset) (linear_resolve(addr, access)(x_{1}))

Repeatedly Skolemizing and flattening,

Expanding the definition of every,

Expanding the definition of linear_resolve,

Expanding the definition of ##,

Expanding the definition of ok_result,

Installing automatic rewrites from: max_linear Mem < bits_per_level bus_width min_linear Address_Helpers.<= max_level pe_size xlat_ofs_memory_address! pdir_lvl ptab_lvl translate_result_leaf translate_result_no_leaf translate_memory_address! translate_memory_address2! xlat_ofs_memory_address2! translate_result_leaf translate_result_no_leaf

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 6 subgoals:

1352

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        linear_resolve_memory_address.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{1} xlat_ofs(0,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)

(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′)`offset

< max_linear_offset

Using lemma xlat_ofs_memory_address,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_memory_address.1.

1353 C Proof scripts

                                                                                                                        linear_resolve_memory_address.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{1} 0 ≤

xlat_ofs(0,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′)`offset

Using lemma xlat_ofs_memory_address2,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_memory_address.2.

1354

C.114 Proofs for Linear_Memory (linear_memory.pvs)

                                                                                                                        linear_resolve_memory_address.3:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{1} Mem?(xlat_ofs(0,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′)`type_of)

Using lemma xlat_ofs_memory_address,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_memory_address.3.

1355 C Proof scripts

                                                                                                                        linear_resolve_memory_address.4:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} OK?(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))

{1} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{2} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)

(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))`2,

addr′)`offset

< max_linear_offset

1356

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Using lemma translate_result_no_leaf,

Using lemma translate_result_no_leaf,

Using lemma translate_result_leaf,

Using lemma xlat_ofs_memory_address,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_memory_address.4.

1357 C Proof scripts

                                                                                                                        linear_resolve_memory_address.5:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} OK?(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))

{1} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{2} 0 ≤

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))`2,

addr′)`offset

1358

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Using lemma xlat_ofs_memory_address2,

Using lemma translate_result_no_leaf,

Using lemma translate_result_no_leaf,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_memory_address.5.

1359 C Proof scripts

                                                                                                                        linear_resolve_memory_address.6:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} OK?(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))

{1} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{2} Mem?(xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))`2,

addr′)`type_of)

1360

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Using lemma translate_result_no_leaf, Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Using lemma translate_memory_address, Using lemma xlat_ofs_memory_address, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.6.

Q.E.D.

C.114.28 Linear_Memory.linear_read_TCC1

Terse proof for linear_read_TCC1.
linear_read_TCC1:

{1} Mem?(min_linear`type_of)

Expanding the definition of min_linear, Rewriting using Mem, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of linear_read_TCC1. Q.E.D.

C.114.29 Linear_Memory.linear_read_TCC2

Terse proof for linear_read_TCC2.
linear_read_TCC2:

{1} Mem?(max_linear`type_of)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true. This completes the proof of linear_read_TCC2. Q.E.D.

C.114.30 Linear_Memory.linear_read_TCC3

Terse proof for linear_read_TCC3.
linear_read_TCC3:

{1} ∀ (a: Address):

Mem?(type_of(a)) ∧ in_memory(min_linear, max_linear)(a) ⊃ 0 ≤ a`offset ∧ a`offset < max_linear_offset

Expanding the definition of min_linear, Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of max_linear, Expanding the definition of max_linear_offset, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_read_TCC3. Q.E.D.

1361 C Proof scripts

C.114.31 Linear_Memory.linear_read_side_effect_TCC1

Terse proof for linear_read_side_effect_TCC1.
linear_read_side_effect_TCC1:

{1} ∀ (a: Address, bl: list[Byte], s: Linear_memory): Mem?(type_of(a)) ∧ (null?(bl) ∨ (reg_base(min_linear)(type_of(a)) ≤ a ∧ a + length(bl) ≤ reg_size(max_linear)(type_of(a)))) ⊃ every[[Address, list[Byte]]] (λ (t: [Address, list[Byte]]): Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Case splitting on bl!1 = null, we get 2 subgoals:

linear_read_side_effect_TCC1.1:

{-1} bl′ = null
{-2} Mem?(type_of(a′))

{-3} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{1} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Using lemma split_null, Expanding the definition of every, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_read_side_effect_TCC1.1.
linear_read_side_effect_TCC1.2:

{-1} Mem?(type_of(a′))

{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{1} bl′ = null

{2} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Using lemma split_range, Using lemma split_no_null, Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

1362

C.114 Proofs for Linear_Memory (linear_memory.pvs)

linear_read_side_effect_TCC1.2.1:

{-1} cons?(bl′)
{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} reg_base(min_linear)(type_of(a′)) ≤ a′
{-6} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} every((λ (a_{2}: Address, bl2: list[Byte]):

cons?(bl2) ∧ a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′))) (split(min_page, a′, bl′))

{2} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Hiding formulas: 2,

Using lemma every_conjunct_left,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_read_side_effect_TCC1.2.1.
linear_read_side_effect_TCC1.2.2:

{-1} cons?(bl′)
{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} reg_base(min_linear)(type_of(a′)) ≤ a′
{-6} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} ∀ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ⊃ Mem?(t_1`1`type_of) ∧ 0 ≤ t_1`1`offset ∧ t_1`1`offset < max_linear_offset

{2} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Hiding formulas: (-2 -3 2),

Trying repeated skolemization, instantiation, and if-lifting,

Expanding the definition of max_linear,

Expanding the definition of Mem,

Expanding the definition of max_linear_offset,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_read_side_effect_TCC1.2.2.

Q.E.D.

1363 C Proof scripts

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

C.115.1 Linear_Memory_Blessing.PTab_Address_TCC1

Terse proof for PTab_Address_TCC1.
PTab_Address_TCC1:

{1} ∀ (a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of PTab_Address_TCC1. Q.E.D.

C.115.2 Linear_Memory_Blessing.pe_in_pdir_range?_TCC1

Terse proof for pe_in_pdir_range?_TCC1.
pe_in_pdir_range?_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G],

phy_a: Memory_Address_4G, res: ExprResult[Physical_memory, Pdbr_type]): OK?(res) ∧ res = read_data(pm_phy, pdbr_data_type)(PDBR)(s) ⊃ (∀ (lin_a: (linear_range)): pdir_lvl[Physical_memory, pm_phy] < max_level)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_pdir_range?_TCC1. Q.E.D.

C.115.3 Linear_Memory_Blessing.pe_in_ptab_range?_TCC1

Terse proof for pe_in_ptab_range?_TCC1.
pe_in_ptab_range?_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range)):

pdir_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_ptab_range?_TCC1. Q.E.D.

C.115.4 Linear_Memory_Blessing.pe_in_ptab_range?_TCC2

Terse proof for pe_in_ptab_range?_TCC2.

1364

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

pe_in_ptab_range?_TCC2:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range), res: ExprResult[Physical_memory, ((range_pt(pdir_lvl[Physical_memory, pm_phy])))]):

OK?(res) ∧ res = read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s) ⊃ pdir?(data[Physical_memory, ((range_pt(pdir_lvl)))](res))

Repeatedly Skolemizing and flattening, Adding type constraints for data[Physical_memory, ((range_pt(pdir_lvl)))](res!1), Expanding the definition of range_pt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pdir_lvl, which is trivially true. This completes the proof of pe_in_ptab_range?_TCC2. Q.E.D.

C.115.5 Linear_Memory_Blessing.pe_in_ptab_range?_TCC3

Terse proof for pe_in_ptab_range?_TCC3.
pe_in_ptab_range?_TCC3:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range), res: ExprResult[Physical_memory, ((range_pt(pdir_lvl[Physical_memory, pm_phy])))]):

pde_pt?(pdir(data(res))) ∧ OK?(res) ∧ res = read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s) ⊃ ptab_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_ptab_range?_TCC3. Q.E.D.

C.115.6 Linear_Memory_Blessing.pe_in_ptab_range?_TCC4

Terse proof for pe_in_ptab_range?_TCC4.
pe_in_ptab_range?_TCC4:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range), res: ExprResult[Physical_memory, ((range_pt(pdir_lvl[Physical_memory, pm_phy])))]):

pde_pt?(pdir(data(res))) ∧ OK?(res) ∧ res = read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s) ⊃ present?(data[Physical_memory, ((range_pt(pdir_lvl)))](res))

Repeatedly Skolemizing and flattening, Expanding the definition of present?,

1365 C Proof scripts

Adding type constraints for data(res!1), Expanding the definition of range_pt, Expanding the definition of pdir_lvl, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pe_in_ptab_range?_TCC4. Q.E.D.

C.115.7 Linear_Memory_Blessing.pe_in_pt_range?_TCC1

Terse proof for pe_in_pt_range?_TCC1.
pe_in_pt_range?_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], lvl: Level, phy_a: Mem-

ory_Address_4G):

¬ (lvl = pdir_lvl[Physical_memory, pm_phy] ∧ lvl = ptab_lvl[Physical_memory, pm_phy])

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_pt_range?_TCC1. Q.E.D.

C.115.8 Linear_Memory_Blessing.pe_in_pt_range?_TCC2

Terse proof for pe_in_pt_range?_TCC2.
pe_in_pt_range?_TCC2:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], lvl: Level, phy_a: Mem-

ory_Address_4G):

lvl = pdir_lvl[Physical_memory, pm_phy] ∨ lvl = ptab_lvl[Physical_memory, pm_phy]

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_pt_range?_TCC2. Q.E.D.

C.115.9 Linear_Memory_Blessing.pe_in_pt_range_aligned

Terse proof for pe_in_pt_range_aligned.
pe_in_pt_range_aligned:

{1} ∀ (linear_range: PRED[Memory_Address_4G], lvl: Level, s: Linear_memory[Physical_memory, pm_phy], phy_a: Memory_Address_4G): pe_in_pt_range?(s, linear_range, lvl)(phy_a) ⊃ aligned?(pe_size)(offset(phy_a))

Expanding the definition of pe_in_pt_range?, Expanding the definition of pe_in_ptab_range?, Expanding the definition of pe_in_pdir_range?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: pe_size bits_per_level xlat_idx_pe_aligned Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

1366

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

pe_in_pt_range_aligned.1:

{-1} lvl′ < max_level
{-2} Mem?(phy_a′`type_of)
{-3} 0 ≤ phy_a′`offset
{-4} phy_a′`offset < max_linear_offset
{-5} lvl′ = pdir_lvl
{-6} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))

{-7} ∃ (lin_a: (linear_range′)):

xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, lin_a)

= phy_a′

{1} aligned?(2)(offset(phy_a′))

Repeatedly Skolemizing and flattening, Adding type constraints for (data(read_data(pm_phy, pdbr_data_type)(PDBR)(s!1))‘base_addr), Using lemma xlat_idx_pe_aligned, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pe_in_pt_range_aligned.1.
pe_in_pt_range_aligned.2:

{-1} lvl′ < max_level
{-2} Mem?(phy_a′`type_of)
{-3} 0 ≤ phy_a′`offset
{-4} phy_a′`offset < max_linear_offset

{-5} ∃ (pde: (pe_in_pdir_range?(s′, linear_range′))):

∃ (lin_a: (linear_range′)):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′)) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′)))) ∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′))), lin_a)

= phy_a′

{1} lvl′ = pdir_lvl
{2} aligned?(2)(offset(phy_a′))

Repeatedly Skolemizing and flattening, Using lemma xlat_idx_pe_aligned, Expanding the definition of base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pe_in_pt_range_aligned.2.

Q.E.D.

C.115.10 Linear_Memory_Blessing.pe_in_pt_address_in_pt

Terse proof for pe_in_pt_address_in_pt.
pe_in_pt_address_in_pt:

{1} ∀ (linear_range: PRED[Memory_Address_4G], lvl: Level,

s: Linear_memory[Physical_memory, pm_phy], base: Memory_Address_4G): pe_in_pt_range?(s, linear_range, lvl)(base) ⊃ (address_block(base, expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s, linear_range)))

Repeatedly Skolemizing and flattening, Expanding the definition of subset?,

1367 C Proof scripts

Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of address_in_pt_range?, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

                                                                                                                   pe_in_pt_address_in_pt.1:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)

{1} ∃ (pe: Memory_Address_4G, lvl: Level):

pe_in_pt_range?(s′, linear_range′, lvl)(pe) ∧ address_block(pe, expt(2, pe_size))(x′)

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                   This completes the proof of pe_in_pt_address_in_pt.1.
                                                                                                                   pe_in_pt_address_in_pt.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)
{1} x′`offset < max_linear_offset

Using lemma pe_in_pt_range_aligned,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of address_block,

Applying disjunctive simplification to flatten sequent,

Using lemma aligned_add_below,

we get 2 subgoals:

                                                                                                                   pe_in_pt_address_in_pt.2.1:

{-1} pe_size ≤ bus_width ∧ offset(base′) < expt(2, bus_width) ∧ aligned?(pe_size)(offset(base′)) ∧ expt(2, pe_size) − 1 < expt(2, pe_size) ⊃ offset(base′) + expt(2, pe_size) − 1 < expt(2, bus_width)

{-2} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-3} aligned?(pe_size)(offset(base′))
{-4} lvl′ < max_level
{-5} Mem?(base′`type_of)
{-6} 0 ≤ base′`offset
{-7} base′`offset < max_linear_offset
{-8} type_of(base′) = type_of(x′)
{-9} offset(x′) < offset(base′) + expt(2, pe_size)
{1} x′`offset < max_linear_offset

Installing automatic rewrites from: (max_linear_offset! bus_width! pe_size!)

Trying repeated skolemization, instantiation, and if-lifting,

1368

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

                                                                                                                        This completes the proof of pe_in_pt_address_in_pt.2.1.
                                                                                                                        pe_in_pt_address_in_pt.2.2:

{-1} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-2} aligned?(pe_size)(offset(base′))
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} type_of(base′) = type_of(x′)
{-8} offset(x′) < offset(base′) + expt(2, pe_size)
{1} expt(2, pe_size) − 1 ≥ 0
{2} x′`offset < max_linear_offset

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of pe_in_pt_address_in_pt.2.2.
                                                                                                                        pe_in_pt_address_in_pt.3:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)
{1} 0 ≤ x′`offset

Expanding the definition of address_block,

which is trivially true.

                                                                                                                        This completes the proof of pe_in_pt_address_in_pt.3.
                                                                                                                        pe_in_pt_address_in_pt.4:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)
{1} Mem?(x′`type_of)

Expanding the definition of address_block,

which is trivially true.

                                                                                                                        This completes the proof of pe_in_pt_address_in_pt.4.

Q.E.D.

C.115.11 Linear_Memory_Blessing.is_linear_plain_memory?_TCC1

                                                                                                                        Terse proof for is_linear_plain_memory?_TCC1.

1369 C Proof scripts

                                                                                                                        is_linear_plain_memory?_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm ⊃ (∀ (s_{1}, s_{2}: (pm`states)): OK?[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS)(s_{1})))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC1.

Q.E.D.

C.115.12 Linear_Memory_Blessing.is_linear_plain_memory?_TCC2

                                                                                                                        Terse proof for is_linear_plain_memory?_TCC2.
                                                                                                                        is_linear_plain_memory?_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm ⊃ (∀ (s_{1}, s_{2}: (pm`states)): OK?[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS)(s_{2})))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC2.

Q.E.D.

C.115.13 Linear_Memory_Blessing.is_linear_plain_memory?_TCC3

                                                                                                                        Terse proof for is_linear_plain_memory?_TCC3.
                                                                                                                        is_linear_plain_memory?_TCC3:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃

(∀ (s_{11}, s_{21}: (pm`states)):

OK?[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{11})))

Repeatedly Skolemizing and flattening,

1370

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

Instantiating quantified variables,

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC3.

Q.E.D.

C.115.14 Linear_Memory_Blessing.is_linear_plain_memory?_TCC4

                                                                                                                        Terse proof for is_linear_plain_memory?_TCC4.
                                                                                                                        is_linear_plain_memory?_TCC4:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃

(∀ (s_{11}, s_{21}: (pm`states)):

OK?[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{21})))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC4.

Q.E.D.

C.115.15 Linear_Memory_Blessing.is_linear_plain_memory?_TCC5

                                                                                                                        Terse proof for is_linear_plain_memory?_TCC5.

1371 C Proof scripts

                                                                                                                        is_linear_plain_memory?_TCC5:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]):

(∀ (s: (pm`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s)))

∧

(∀ (s_{1}, s_{2}: (pm`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr))))

∧

(∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)))

∧ pm`mem = linear_pm ⊃

(∀ (s_{11}, s_{21}: (pm`states), lvl1: Level,

a_{1}:

(pe_in_pt_range?(s_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl1))):

OK?[Physical_memory, ((range_pt(lvl1)))]

(read_data[Physical_memory, ((range_pt(lvl1)))] (pm_phy, paging_data_type(lvl1))(a_{1})(s_{11})))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

1372

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC5.

Q.E.D.

C.115.16 Linear_Memory_Blessing.is_linear_plain_memory?_TCC6

                                                                                                                        Terse proof for is_linear_plain_memory?_TCC6.

1373 C Proof scripts

                                                                                                                        is_linear_plain_memory?_TCC6:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]):

(∀ (s: (pm`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s)))

∧

(∀ (s_{1}, s_{2}: (pm`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr))))

∧

(∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃

(∀ (s_{11}, s_{21}: (pm`states), lvl1: Level,

a_{1}:

(pe_in_pt_range?(s_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl1))):

OK?[Physical_memory, ((range_pt(lvl1)))]

(read_data[Physical_memory, ((range_pt(lvl1)))] (pm_phy, paging_data_type(lvl1))(a_{1})(s_{21})))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

1374

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

Instantiating quantified variables,

we get 2 subgoals:

                                                                                                                        is_linear_plain_memory?_TCC6.1:

{-1} pm′`states(s′_{11})
{-2} pm′`states(s′_{21})
{-3} lvl1′ < max_level
{-4} Mem?(a′_{1}`type_of)
{-5} 0 ≤ a′_{1}`offset
{-6} a′_{1}`offset < max_linear_offset
{-7} pe_in_pt_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})
{-8} pe_in_pdir_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-13} pm′`mem = linear_pm
{1} pe_in_pt_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{2} OK?[Physical_memory, ((range_pt(lvl1′)))]

(read_data[Physical_memory, ((range_pt(lvl1′)))] (pm_phy, paging_data_type(lvl1′))(a′_{1})(s′_{21}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of pe_in_pt_range?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC6.1.

1375 C Proof scripts

                                                                                                                        is_linear_plain_memory?_TCC6.2:

{-1} pm′`states(s′_{11})
{-2} pm′`states(s′_{21})
{-3} lvl1′ < max_level
{-4} Mem?(a′_{1}`type_of)
{-5} 0 ≤ a′_{1}`offset
{-6} a′_{1}`offset < max_linear_offset
{-7} pe_in_pt_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{-8} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-9} pe_in_pdir_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-14} pm′`mem = linear_pm
{1} pe_in_pt_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{2} OK?[Physical_memory, ((range_pt(lvl1′)))]

(read_data[Physical_memory, ((range_pt(lvl1′)))] (pm_phy, paging_data_type(lvl1′))(a′_{1})(s′_{21}))

Expanding the definition of pe_in_pt_range?,

1376

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of is_linear_plain_memory?_TCC6.2.

Q.E.D.

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

C.116.1

Linear_Memory_Blessing_Properties.linear_plain_transformers_ok

                                                                                                                        Terse proof for linear_plain_transformers_ok.
                                                                                                                        linear_plain_transformers_ok:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ transformers_ok?(pm`states,

((memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_transformers (pm‘mem, pm‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))

Installing automatic rewrites from: (linear_resolve_read_transformers_ok linear_resolve_write_transformers_ok linear_resolve_transformer_invariant singleton member)

Repeatedly Skolemizing and flattening,

Rewriting using transformers_ok_all_transformers, matching in *,

Hiding formulas: 2,

Repeatedly Skolemizing and flattening, Expanding the definition of union, Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

                                                                                                                        linear_plain_transformers_ok.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_read_transformers,

Repeatedly Skolemizing and flattening,

Replacing using formula -5,

Hiding formulas: -5,

Rewriting using pm_read_linear, matching in *,

Expanding the definition of linear_read,

Using lemma pm_memory_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (pa: Address): FORALL (s: (pm!1‘states)): OK?(linear_resolve(a!1, Read)(s)) IMPLIES pa = data(linear_resolve(a!1, Read)(s)),

we get 4 subgoals:

1377 C Proof scripts

                                                                                                                        linear_plain_transformers_ok.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{1} transformers_ok?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Read))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Hiding formulas: 2,

Using lemma linear_resolve_read_transformers_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-3 1) and hiding *,

Expanding the definition of transformers_ok?,

Repeatedly Skolemizing and flattening,

Instantiating the top quantifier in -1 with the terms: (s!1 q!2),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Replacing using formula -2, Hiding formulas: (-2 2), Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.1.1.
                                                                                                                        linear_plain_transformers_ok.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{1} transformer_invariant?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Read))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Hiding formulas: 2,

Using lemma linear_resolve_transformer_invariant,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-3 1) and hiding *,

Expanding the definition of transformer_invariant?,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Replacing using formula -2, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

1378

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        This completes the proof of linear_plain_transformers_ok.1.2.
                                                                                                                        linear_plain_transformers_ok.1.3:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states

{1} ∀ (s_1: (pm′`states)):

OK?(linear_resolve(a′, Read)(s_1)) ⊃

(∀ (s: (pm′`states)): OK?(linear_resolve(a′, Read)(s)) ⊃ data(linear_resolve(a′, Read)(s_1)) = data(linear_resolve(a′, Read)(s)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening, Using lemma linear_resolve_same_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.1.3.
                                                                                                                        linear_plain_transformers_ok.1.4:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{1} ∀ (d:

(λ (pa: Address):

∀ (s: (pm′`states)): OK?(linear_resolve(a′, Read)(s)) ⊃ pa = data(linear_resolve(a′, Read)(s)))):

transformers_ok?(pm′`states, singleton(expr_2_super(memory_read(pm_phy`mem)(d)))) {2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Repeatedly Skolemizing and flattening,

Hiding formulas: 2,

Using lemma plain_memory_transformers_ok_read_ro_rw,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of transformers_ok?,

Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Hiding formulas: (-3 -5 2),

1379 C Proof scripts

Instantiating quantified variables,

Using lemma pm_linear_resolve_read_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Replacing using formula -3,

Expanding the definition of memory_read_transformers,

Instantiating quantified variables, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -4 -5 -6 -7), Expanding the definition of restrict, Expanding the definition of subset?, Expanding the definition of virt_to_phys_range, Instantiating the top quantifier in -1 with the terms: (d!1), we get 2 subgoals:

                                                                                                                        linear_plain_transformers_ok.1.4.1:

{-1} (d′ ∈ λ (phy_a: Memory_Address_4G ) : ∃ (lin_a: ((λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))), ac : ((singleton(Read) ∪ singleton(Execute)))) : OK?(linear_resolve(lin_a, ac)(s′)) ∧ data(linear_resolve(lin_a, ac)(s′)) = phy_a)

⇒ (d′ ∈ λ (s : Memory_Address_4G ) : union(pm_phy‘ro_addr, pm_phy‘rw_addr)(s))

{-2} is_linear_plain_memory?(pm′)
{-3} OK?(linear_resolve(a′, Read)(s′))
{-4} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-5} pm′`states(s′)
{-6} plain_memory?(pm_phy)
{-7} d′ = data(linear_resolve(a′, Read)(s′))
{-8} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-9} in_memory(min_linear, max_linear)(a′)
{-10} Mem?(type_of(a′))
{-11} pm′`states = pm_phy`states
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Instantiating quantified variables,

we get 3 subgoals:

                                                                                                                        linear_plain_transformers_ok.1.4.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states
{1} OK?(linear_resolve(a′, Read)(s′)) ∧ data(linear_resolve(a′, Read)(s′)) = d′
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.1.4.1.1.

1380

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.1.4.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states

{1} union[Memory_access]

(singleton[Memory_access](Read), singleton[Memory_access](Execute))(Read)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.1.2.
linear_plain_transformers_ok.1.4.1.3:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states

{1} union[Memory_Address_4G]

(λ (s: Memory_Address_4G): pm′`ro_addr(s),

λ (s: Memory_Address_4G): pm′`rw_addr(s)) (a′)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Keeping (-7 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.1.3.
linear_plain_transformers_ok.1.4.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states
{1} Mem?(d′`type_of) ∧ 0 ≤ d′`offset ∧ d′`offset < max_linear_offset
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

1381 C Proof scripts

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.2.
linear_plain_transformers_ok.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_write_transformers(pm′`mem, pm′`rw_addr)(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_write_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -6, Hiding formulas: -6, Rewriting using pm_write_linear, matching in *, Expanding the definition of linear_write, Using lemma pm_memory_addr, Installing automatic rewrites from: union_right Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA

(pa: Address): FORALL (s: (pm!1‘states)): OK?(linear_resolve(a!1, Write)(s)) IMPLIES pa = data(linear_resolve(a!1, Write)(s)),

we get 4 subgoals:

linear_plain_transformers_ok.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)
{1} transformers_ok?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Write))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address):

mem-

ory_write(pm_phy`mem)(pa, b′)))))

Hiding formulas: 2, Using lemma linear_resolve_write_transformers_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.1.

1382

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)
{1} transformer_invariant?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Write))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address):

mem-

ory_write(pm_phy`mem)(pa, b′)))))

Hiding formulas: 2, Using lemma linear_resolve_transformer_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 1) and hiding *, Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.2.
linear_plain_transformers_ok.2.3:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)

{1} ∀ (s_1: (pm′`states)):

OK?(linear_resolve(a′, Write)(s_1)) ⊃ (∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ data(linear_resolve(a′, Write)(s_1)) = data(linear_resolve(a′, Write)(s)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address):

mem-

ory_write(pm_phy`mem)(pa, b′)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma linear_resolve_same_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.3.

1383 C Proof scripts

linear_plain_transformers_ok.2.4:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)

{1} ∀ (d:

(λ (pa: Address):

∀ (s: (pm′`states)): OK?(linear_resolve(a′, Write)(s)) ⊃ pa = data(linear_resolve(a′, Write)(s)))):

transformers_ok?(pm′`states,

singleton(expr_2_super(memory_write(pm_phy`mem)(d, b′))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address):

mem-

ory_write(pm_phy`mem)(pa, b′)))))

Repeatedly Skolemizing and flattening, Hiding formulas: 2, Using lemma plain_memory_transformers_ok_write_block, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

linear_plain_transformers_ok.2.4.1:

{-1} plain_memory?(pm_phy)

{-2} ∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ d′ = data(linear_resolve(a′, Write)(s))

{-3} is_linear_plain_memory?(pm′)
{-4} in_memory(min_linear, max_linear)(a′)
{-5} Mem?(type_of(a′))
{-6} b′ < max_byte
{-7} pm′`states = pm_phy`states
{-8} pm′`rw_addr(a′)

{1} transformers_ok?(pm′`states, memory_write_transformers(pm_phy`mem, ad-

dress_block(d′, 1)))

{2} transformers_ok?(pm′`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))))
{3} (address_block(d′, 1) ⊆ pm_phy‘rw_addr)

Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Hiding formulas: (1 2), Instantiating quantified variables, Expanding the definition of address_block, Hiding formulas: (-2), Using lemma pm_linear_resolve_write_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?,

1384

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -5 -6 -7), Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 3 subgoals:

linear_plain_transformers_ok.2.4.1.1:

{-1} (x′ ∈ virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write)))

⇒ (x′ ∈ restrict[Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′)
{-3} OK?(linear_resolve(a′, Write)(s′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} (x′ ∈ λ (a : Address) : type_of(d′) = type_of(a) ∧ offset(d′) ≤ offset(a) ∧ offset(a) < 1 + offset(d′))
{-7} d′ = data(linear_resolve(a′, Write)(s′))
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} b′ < max_byte
{-11} pm′`states = pm_phy`states
{-12} pm′`rw_addr(a′)
{1} (x′ ∈ pm_phy‘rw_addr)

Expanding the definition of restrict, Expanding the definition of virt_to_phys_range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on d!1 = x!1, we get 2 subgoals:

linear_plain_transformers_ok.2.4.1.1.1:

{-1} d′ = x′
{-2} OK?(linear_resolve(a′, Write)(s′))
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} type_of(d′) = type_of(x′)
{-7} offset(d′) ≤ offset(x′)
{-8} offset(x′) < 1 + offset(d′)
{-9} d′ = data(linear_resolve(a′, Write)(s′))
{-10} in_memory(min_linear, max_linear)(a′)
{-11} Mem?(type_of(a′))
{-12} b′ < max_byte
{-13} pm′`states = pm_phy`states
{-14} pm′`rw_addr(a′)
{1} data(linear_resolve(a′, Write)(s′)) = x′
{2} pm_phy`rw_addr(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.4.1.1.1.

1385 C Proof scripts

linear_plain_transformers_ok.2.4.1.1.2:

{-1} OK?(linear_resolve(a′, Write)(s′))
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} plain_memory?(pm_phy)
{-5} type_of(d′) = type_of(x′)
{-6} offset(d′) ≤ offset(x′)
{-7} offset(x′) < 1 + offset(d′)
{-8} d′ = data(linear_resolve(a′, Write)(s′))
{-9} in_memory(min_linear, max_linear)(a′)
{-10} Mem?(type_of(a′))
{-11} b′ < max_byte
{-12} pm′`states = pm_phy`states
{-13} pm′`rw_addr(a′)
{1} d′ = x′
{2} data(linear_resolve(a′, Write)(s′)) = x′
{3} pm_phy`rw_addr(x′)

Keeping (-5 -6 -7 1) and hiding *,

Applying decompose-equality,

This completes the proof of linear_plain_transformers_ok.2.4.1.1.2.
linear_plain_transformers_ok.2.4.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Write)(s′))
{-3} pm′`states(s′)
{-4} plain_memory?(pm_phy)
{-5} (x′ ∈ λ (a : Address) : type_of(d′) = type_of(a) ∧ offset(d′) ≤ offset(a) ∧ offset(a) < 1 + offset(d′))
{-6} d′ = data(linear_resolve(a′, Write)(s′))
{-7} in_memory(min_linear, max_linear)(a′)
{-8} Mem?(type_of(a′))
{-9} b′ < max_byte
{-10} pm′`states = pm_phy`states
{-11} pm′`rw_addr(a′)
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset
{2} (x′ ∈ pm_phy‘rw_addr)

Using lemma linear_resolve_memory_address,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.4.1.2.

1386

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.2.4.1.3:

{-1} ∀ (x: Memory_Address_4G):

(x ∈ virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write)))

⇒ (x ∈ restrict[Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′)
{-3} OK?(linear_resolve(a′, Write)(s′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} (x′ ∈ λ (a : Address) : type_of(d′) = type_of(a) ∧ offset(d′) ≤ offset(a) ∧ offset(a) < 1 + offset(d′))
{-7} d′ = data(linear_resolve(a′, Write)(s′))
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} b′ < max_byte
{-11} pm′`states = pm_phy`states
{-12} pm′`rw_addr(a′)
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset
{2} (x′ ∈ pm_phy‘rw_addr)

Using lemma linear_resolve_memory_address,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.4.1.3.
linear_plain_transformers_ok.2.4.2:

{-1} plain_memory?(pm_phy)

{-2} transformers_ok?(pm_phy`states, memory_write_transformers(pm_phy`mem, ad-

dress_block(d′, 1))) {-3} ∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ d′ = data(linear_resolve(a′, Write)(s))

{-4} is_linear_plain_memory?(pm′)
{-5} in_memory(min_linear, max_linear)(a′)
{-6} Mem?(type_of(a′))
{-7} b′ < max_byte
{-8} pm′`states = pm_phy`states
{-9} pm′`rw_addr(a′)
{1} (singleton(expr_2_super (memory_write(pm_phy‘mem)(d′, b′))) ⊆ memory_write_transformers (pm_phy‘mem, address_block(d′, 1)))
{2} transformers_ok?(pm′`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))))

Expanding the definition of subset?,

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

Replacing using formula -1,

Expanding the definition of memory_write_transformers,

Instantiating quantified variables,

Expanding the definition of address_block,

which is trivially true.

This completes the proof of linear_plain_transformers_ok.2.4.2.

1387 C Proof scripts

                                                                                                                   linear_plain_transformers_ok.2.4.3:

{-1} plain_memory?(pm_phy)
{-2} ∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ d′ = data(linear_resolve(a′, Write)(s))

{-3} is_linear_plain_memory?(pm′)
{-4} in_memory(min_linear, max_linear)(a′)
{-5} Mem?(type_of(a′))
{-6} b′ < max_byte
{-7} pm′`states = pm_phy`states
{-8} pm′`rw_addr(a′)
{1} (singleton(expr_2_super (memory_write(pm_phy‘mem)(d′, b′))) ⊆ memory_write_transformers (pm_phy‘mem, address_block(d′, 1)))
{2} transformers_ok?(pm′`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))))
{3} (address_block(d′, 1) ⊆ pm_phy‘rw_addr)

Expanding the definition of subset?,

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

Replacing using formula -1,

Expanding the definition of memory_write_transformers,

Instantiating quantified variables,

Expanding the definition of address_block,

which is trivially true.

                                                                                                                   This completes the proof of linear_plain_transformers_ok.2.4.3.
                                                                                                                   linear_plain_transformers_ok.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_read_side_effect_super_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_read_side_effect_super_transformers,

Repeatedly Skolemizing and flattening,

Replacing using formula -6,

Hiding formulas: (-1 -6),

Rewriting using pm_read_side_effect_linear, matching in *,

Expanding the definition of linear_read_side_effect,

Case splitting on null?(bl!1) OR (reg_base(min_linear)(type_of(a!1)) <= a!1 AND a!1 + length(bl!1) <= reg_size(max_linear)(type_of(a!1))),

we get 4 subgoals:

1388

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        linear_plain_transformers_ok.3.1:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Case splitting on Mem?(type_of(a!1)),

we get 2 subgoals:

1389 C Proof scripts

                                                                                                                        linear_plain_transformers_ok.3.1.1:

{-1} Mem?(type_of(a′))
{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -2,

Simplifying, rewriting, and recording with decision procedures,

Case splitting on null?(bl!1),

we get 2 subgoals:

                                                                                                                        linear_plain_transformers_ok.3.1.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))
{-3} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-4} is_linear_plain_memory?(pm′)
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_read_side_effect_in_page)

(s))))

1390

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Hiding formulas: -3, Using lemma split_null, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Expanding the definition of ok_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.1.1.1.
                                                                                                                        linear_plain_transformers_ok.3.1.1.2:

{-1} Mem?(type_of(a′))
{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} null?(bl′)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_read_side_effect_in_page)

(s))))

Hiding formulas: -2,

Expanding the definition of transformers_ok?,

Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -7, Hiding formulas: -7, Case splitting on 0 <= a!1‘offset AND a!1‘offset < max_linear_offset, we get 2 subgoals:

                                                                                                                        linear_plain_transformers_ok.3.1.1.2.1:

{-1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} pm′`states(s′)
{1} null?(bl′)

{2} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s))

(s′))

Using lemma address_block_split_type,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using ok_expr_2_super, matching in *,

1391 C Proof scripts

Using lemma apply_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        linear_plain_transformers_ok.3.1.1.2.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} Mem?(type_of(a′))
{-8} plain_memory?(pm_phy)
{-9} pm′`states = pm_phy`states

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{3} null?(bl′)

Using lemma split_linear_read_side_effects_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.1.1.2.1.1.
                                                                                                                        linear_plain_transformers_ok.3.1.1.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} Mem?(type_of(a′))
{-8} plain_memory?(pm_phy)
{-9} pm′`states = pm_phy`states
{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{3} null?(bl′)

Repeatedly Skolemizing and flattening,

Using lemma split_linear_read_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.1.1.2.1.2.

1392

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        linear_plain_transformers_ok.3.1.1.2.2:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{2} null?(bl′)

{3} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s))

(s′))

Hiding formulas: 3,

Expanding the definition of length,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of subset?,

Instantiating quantified variables,

Using lemma pm_memory_addr,

Expanding the definition of address_block,

Expanding the definition of in_memory,

Expanding the definition of reg_size,

Expanding the definition of <,

Expanding the definition of max_linear,

Expanding the definition of reg_base,

Expanding the definition of min_linear,

Expanding the definition of Mem,

Expanding the definition of <=,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.1.1.2.2.

1393 C Proof scripts

                                                                                                                        linear_plain_transformers_ok.3.1.2:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} Mem?(type_of(a′))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -1,

Simplifying, rewriting, and recording with decision procedures,

Using lemma plain_memory_transformers_ok_read_side_effects_ro_rw, Using lemma transformers_ok_mono_transformers, Hiding formulas: -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-2 2), Expanding the definition of memory_read_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Replacing using formula -1, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -6 with the terms: x′′, Expanding the definition of address_block, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

1394

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.1.2.

                                                                                                                        linear_plain_transformers_ok.3.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Hiding formulas: 2,

Expanding the definition of length,

Applying disjunctive simplification to flatten sequent,

Using lemma pm_memory_addr,

Using lemma pm_memory_addr,

we get 2 subgoals:

1395 C Proof scripts

                                                                                                                        linear_plain_transformers_ok.3.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′ + length(cdr(bl′))) ⊃ in_memory(min_linear, max_linear)(a′ + length(cdr(bl′))) ∧ Mem?(type_of(a′ + length(cdr(bl′))))

{-2} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} null?(bl′)

{2} (reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: (-4 -3),

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.2.1.

                                                                                                                        linear_plain_transformers_ok.3.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} cons?[Byte](bl′)
{2} null?(bl′)

{3} (reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.2.2.

1396

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        linear_plain_transformers_ok.3.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ¬ null?(bl′) ∧ reg_base(min_linear)(type_of(a′)) ≤ a′ ⊃ Mem?(max_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.3.

1397 C Proof scripts

                                                                                                                        linear_plain_transformers_ok.3.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ¬ null?(bl′) ⊃ Mem?(min_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

                                                                                                                        This completes the proof of linear_plain_transformers_ok.3.4.
                                                                                                                        linear_plain_transformers_ok.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr)(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_write_side_effect_super_transformers,

Repeatedly Skolemizing and flattening,

Replacing using formula -6, Hiding formulas: (-1 -6), Rewriting using pm_write_side_effect_linear, matching in *, Expanding the definition of linear_write_side_effect, Case splitting on null?(bl!1) OR (reg_base(min_linear)(type_of(a!1)) <= a!1 AND a!1 + length(bl!1)

<= reg_size(max_linear)(type_of(a!1))), we get 4 subgoals:

1398

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        linear_plain_transformers_ok.4.1:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Case splitting on Mem?(type_of(a!1)),

we get 2 subgoals:

1399 C Proof scripts

                                                                                                                        linear_plain_transformers_ok.4.1.1:

{-1} Mem?(type_of(a′))
{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -2,

Simplifying, rewriting, and recording with decision procedures,

Case splitting on null?(bl!1),

we get 2 subgoals:

                                                                                                                        linear_plain_transformers_ok.4.1.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))
{-3} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-4} is_linear_plain_memory?(pm′)
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_write_side_effect_in_page)

(s))))

1400

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Hiding formulas: -3, Using lemma split_null, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Expanding the definition of ok_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.1.1.1.
linear_plain_transformers_ok.4.1.1.2:

{-1} Mem?(type_of(a′))

{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} null?(bl′)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page) (s))))

Hiding formulas: -2, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -7, Hiding formulas: -7, Case splitting on 0 <= a!1‘offset AND a!1‘offset < max_linear_offset, we get 2 subgoals:

linear_plain_transformers_ok.4.1.1.2.1:

{-1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} pm′`states(s′)
{1} null?(bl′)

{2} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

C Proof scripts

linear_plain_transformers_ok.4.1.1.2.1.1:

{-1} is_linear_plain_memory?(pm′)

{-2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} Mem?(type_of(a′))
{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)
{1} null?(bl′)

{2} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Rewriting using ok_expr_2_super, matching in *,

Using lemma apply_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_transformers_ok.4.1.1.2.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{3} null?(bl′)

Using lemma split_linear_write_side_effects_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.1.1.1.

1402

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.4.1.1.2.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{3} null?(bl′)

Repeatedly Skolemizing and flattening,

Using lemma split_linear_write_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.1.1.2.
linear_plain_transformers_ok.4.1.1.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} 0 ≤ a′`offset
{-3} a′`offset < max_linear_offset
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)
{1} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{2} null?(bl′)

{3} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Hiding formulas: 3,

Keeping (-6 1) and hiding *,

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets pm!1‘rw_addr,

Rewriting using union_subset3, matching in *,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.1.2.

1403 C Proof scripts

linear_plain_transformers_ok.4.1.1.2.2:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{2} null?(bl′)

{3} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Hiding formulas: 3,

Expanding the definition of length,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of subset?,

Instantiating quantified variables,

Using lemma pm_memory_addr,

Expanding the definition of address_block,

Expanding the definition of in_memory,

Expanding the definition of reg_size,

Expanding the definition of <,

Expanding the definition of max_linear,

Expanding the definition of reg_base,

Expanding the definition of min_linear,

Expanding the definition of Mem,

Expanding the definition of <=,

Rewriting using union_right, matching in *,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.2.

1404

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.4.1.2:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} Mem?(type_of(a′))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_transformers_ok_write_side_effects_ro_rw, Using lemma transformers_ok_mono_transformers, Hiding formulas: -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-2 2), Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Replacing using formula -1, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -6 with the terms: x′′, Expanding the definition of address_block, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

1405 C Proof scripts

Rewriting using union_right, matching in *,

This completes the proof of linear_plain_transformers_ok.4.1.2.

linear_plain_transformers_ok.4.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Hiding formulas: 2,

Expanding the definition of length,

Using lemma pm_memory_addr,

Using lemma pm_memory_addr,

we get 2 subgoals:

1406

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.4.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′ + length(cdr(bl′))) ⊃ in_memory(min_linear, max_linear)(a′ + length(cdr(bl′))) ∧ Mem?(type_of(a′ + length(cdr(bl′))))

{-2} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ pm′‘rw_addr)
{1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: (-4 -3),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.2.1.

linear_plain_transformers_ok.4.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ pm′‘rw_addr)
{1} cons?[Byte](bl′)
{2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_plain_transformers_ok.4.2.2.

1407 C Proof scripts

                                                                                                                   linear_plain_transformers_ok.4.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ¬ null?(bl′) ∧ reg_base(min_linear)(type_of(a′)) ≤ a′ ⊃ Mem?(max_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

                                                                                                                   This completes the proof of linear_plain_transformers_ok.4.3.

1408

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

                                                                                                                        linear_plain_transformers_ok.4.4:

{

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of ##,

Using lemma set_reference_present,

Using lemma set_reference_base,

Using lemma set_reference_accessible,

Using lemma set_reference_privileged,

Using lemma set_reference_leaf,

Using lemma set_reference_paging_type,

Case splitting on OK?(write_data(pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1), set_reference(data(read_data (pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1)) (s2!1)), access!1)) (state(read_data(pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1)) (s2!1)))),

we get 4 subgoals:

1661 C Proof scripts

translate_result_ok.1.1:

{-1} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-7} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-8} lvl′ < max_level
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} Mem?(base′`type_of)
{-12} 0 ≤ base′`offset
{-13} base′`offset < max_linear_offset
{-14} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-15} Mem?(lin_a′`type_of)
{-16} 0 ≤ lin_a′`offset
{-17} lin_a′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-19} pm′`mem = linear_pm

{-20} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-22} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-23} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-24} plain_memory?(pm_phy)
{-25} pm′`states = pm_phy`states
{-26} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-27} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-28} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-29} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-30} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-31} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-32} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-33} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-34} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-35} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-36} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

## ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data)

then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′) endif

else raise_fault(priv′, access′, false, lin_a′) endif

else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1662

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Installing automatic rewrites from: ## ok_result

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_ok.1.1.

1663 C Proof scripts

translate_result_ok.1.2:

{-1} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-7} lvl′ < max_level
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} pm′`mem = linear_pm

{-19} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-22} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-23} plain_memory?(pm_phy)
{-24} pm′`states = pm_phy`states
{-25} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-26} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-27} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-28} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-29} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-30} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-31} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-32} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-33} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-34} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-35} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

## ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{2} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data)

then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′) endif

else raise_fault(priv′, access′, false, lin_a′) endif

else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1664

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Using lemma plain_memory_write_data_ok,

Case splitting on in_blessed_memory?(paging_data_type(lvl!1), xlat_idx(lvl!1, base!1, lin_a!1), pm_phy‘rw_addr),

we get 2 subgoals:

1665 C Proof scripts

translate_result_ok.1.2.1:

{-1} in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′), pm_phy`rw_addr)

{-2} plain_memory?(pm_phy) ∧

pm_phy`states

(state(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

∧

in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′),

pm_phy`rw_addr)

⊃

OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

=

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

=

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-7} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

=

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-8} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-9} lvl′ < max_level
{-10} pm′`states(s′_{1})
{-11} pm′`states(s′_{2})
{-12} Mem?(base′`type_of)
{-13} 0 ≤ base′`offset
{-14} base′`offset < max_linear_offset
{-15} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-16} Mem?(lin_a′`type_of)
{-17} 0 ≤ lin_a′`offset
{-18} lin_a′`offset < max_linear_offset
{-19} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-20} pm′`mem = linear_pm

{-21} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-22} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-23} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-24} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-25} plain_memory?(pm_phy)
{-26} pm′`states = pm_phy`states
{-27} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-28} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-29} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-30} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-31} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-32} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-33} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-34} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-35} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-36} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-37} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

1666

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma plain_memory_transformer_invariant_read_data,

Using lemma expr_transformer_invariant_next_ok,

Expanding the definition of singleton,

Installing automatic rewrites from: has_next_state in_blessed_memory_rw_ro

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                            This completes the proof of translate_result_ok.1.2.1.

1667 C Proof scripts

                                                                                                                        translate_result_ok.1.2.2:

{-1} plain_memory?(pm_phy) ∧ pm_phy`states

(state(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

∧

in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′),

pm_phy`rw_addr)

⊃

OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

=

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

=

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

=

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}))) {-7} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-8} lvl′ < max_level
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} Mem?(base′`type_of)
{-12} 0 ≤ base′`offset
{-13} base′`offset < max_linear_offset
{-14} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-15} Mem?(lin_a′`type_of)
{-16} 0 ≤ lin_a′`offset
{-17} lin_a′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-19} pm′`mem = linear_pm
{-20} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-22} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-23} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-24} plain_memory?(pm_phy)
{-25} pm′`states = pm_phy`states
{-26} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-27} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-28} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-29} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-30} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-31} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-32} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-33} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-34} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-35} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-36} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′), pm_phy`rw_addr)

{2} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

1668

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of in_blessed_memory?,

Rewriting using paging_data_type_size, matching in *,

Hiding formulas: (-1 -2 -3 -4 -5 -6 -7 2),

Using lemma pe_in_pt_address_in_pt,

Using lemma subset_ptab_address_rw_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Instantiating the top quantifier in -24 with the terms: (s1!1),

Expanding the definition of linear_blessed?,

which is trivially true.

                                                                                                                        This completes the proof of translate_result_ok.1.2.2.

1669 C Proof scripts

                                                                                                                        translate_result_ok.1.3:

{-1} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

=

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

=

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

=

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}))) {-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-7} lvl′ < max_level
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} pm′`mem = linear_pm
{-19} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-22} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-23} plain_memory?(pm_phy)
{-24} pm′`states = pm_phy`states
{-25} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-26} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-27} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-28} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-29} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-30} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-31} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-32} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-33} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-34} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-35} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} range_pt(lvl′)

(set_reference(data[Physical_memory, ((range_pt(lvl′)))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm_phy, paging_data_type(lvl′)) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′)) (s′_{2})),

access′))

{2} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data) then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1670

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Rewriting using set_reference_range, matching in *,

This completes the proof of translate_result_ok.1.3.

1671 C Proof scripts

                                                                                                                        translate_result_ok.1.4:

{-1} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

=

privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

=

accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

=

base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}))) {-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

=

present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-7} lvl′ < max_level
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} pm′`mem = linear_pm
{-19} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-22} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-23} plain_memory?(pm_phy)
{-24} pm′`states = pm_phy`states
{-25} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-26} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-27} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-28} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-29} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-30} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-31} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-32} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-33} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-34} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-35} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?[Physical_memory, (range_pt(lvl′))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm_phy, paging_data_type(lvl′)) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′))(s′_{2}))

∨

Exception?[Physical_memory, (range_pt(lvl′))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm_phy, paging_data_type(lvl′)) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′))(s′_{2}))

{2} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data) then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1672

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_ok.1.4.

1673 C Proof scripts

                                                                                                                        translate_result_ok.2:

{-1} lvl′ < max_level
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-8} Mem?(lin_a′`type_of)
{-9} 0 ≤ lin_a′`offset
{-10} lin_a′`offset < max_linear_offset
{-11} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-12} pm′`mem = linear_pm
{-13} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-16} plain_memory?(pm_phy)
{-17} pm′`states = pm_phy`states
{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-23} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-24} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-25} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-26} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-27} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-28} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{2}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

lvl′) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′))

{2} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif))

(s′_{2}))

1674

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of pe_in_pt_range?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_ok.2.

Q.E.D.

C.117.35 Linear_Memory_Properties.translate_result_as_read_TCC1

                                                                                                                        Terse proof for translate_result_as_read_TCC1.
                                                                                                                        translate_result_as_read_TCC1:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s: Lin-

ear_memory[Physical_memory, pm_phy], base: PTab_Address[Physical_memory, pm_phy], lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ OK?(translate(lvl, base, lin_a, access, priv)(s)) ⊃ (∀ (res: ExprResult[Physical_memory, ((range_pt(lvl)))]):

res = read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s) ⊃ OK?[Physical_memory, ((range_pt(lvl)))](res))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of translate_result_as_read_TCC1.

Q.E.D.

C.117.36 Linear_Memory_Properties.translate_result_as_read_TCC2

                                                                                                                        Terse proof for translate_result_as_read_TCC2.
                                                                                                                        translate_result_as_read_TCC2:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s: Lin-

ear_memory[Physical_memory, pm_phy], base: PTab_Address[Physical_memory, pm_phy], lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ OK?(translate(lvl, base, lin_a, access, priv)(s)) ⊃ (∀ (res: ExprResult[Physical_memory, ((range_pt(lvl)))]):

res = read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s) ⊃ present?(data[Physical_memory, ((range_pt(lvl)))](res)))

Repeatedly Skolemizing and flattening,

Hiding formulas: -10,

Expanding the definition of translate,

Installing automatic rewrites from: ( ##! raise_fault! fatal_result! exception_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of translate_result_as_read_TCC2.

Q.E.D.

1675 C Proof scripts

C.117.37 Linear_Memory_Properties.translate_result_as_read

                                                                                                                        Terse proof for translate_result_as_read.
                                                                                                                        translate_result_as_read:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s: Lin-

ear_memory[Physical_memory, pm_phy],

base: PTab_Address, lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ OK?(translate(lvl, base, lin_a, access, priv)(s)) ⊃ let res = read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s) in

data(translate(lvl, base, lin_a, access, priv)(s)) =

(is_leaf?(data(res)), base(data(res)))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res! ok_result! fatal_result!

raise_fault! exception_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of translate_result_as_read.

Q.E.D.

C.117.38 Linear_Memory_Properties.translate_same_result

                                                                                                                        Terse proof for translate_same_result.
                                                                                                                        translate_same_result:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s_{1}, s_{2}: (pm`states), base: PTab_Address,

lin_a: Memory_Address_4G, ac1, ac2: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl)

(xlat_idx(lvl, base, lin_a))

∧

OK?(translate(lvl, base, lin_a, ac1, priv)(s_{1})) ∧ OK?(translate(lvl, base, lin_a, ac2, priv)(s_{2}))

⊃

data(translate(lvl, base, lin_a, ac1, priv)(s_{1})) = data(translate(lvl, base, lin_a, ac2, priv)(s_{2}))

Repeatedly Skolemizing and flattening, Using lemma translate_result_as_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma translate_result_as_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of is_linear_plain_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

1676

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Instantiating the top quantifier in -9 with the terms: (s1!1 s2!1 lvl!1 xlat_idx(lvl!1, base!1, lin_a!1)), Using lemma set_reference_leaf, Using lemma set_reference_base, Using lemma set_reference_present, Keeping (-1 -2 -3 -12 -19 -20 -21 -22 1) and hiding *, Replacing using formula -6, Replacing using formula -8, Hiding formulas: (-6 -8), Expanding the definition of translate, Installing automatic rewrites from: ( ##! expr_2_super! raise_fault! expr_2_super_res! excep-

tion_result! ok_result! fatal_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_same_result.

Q.E.D.

C.117.39 Linear_Memory_Properties.xlat_pe_in_pdir_range_TCC1

                                                                                                                        Terse proof for xlat_pe_in_pdir_range_TCC1.
                                                                                                                        xlat_pe_in_pdir_range_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ pdir_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pdir_range_TCC1.

Q.E.D.

C.117.40 Linear_Memory_Properties.xlat_pe_in_pdir_range_TCC2

                                                                                                                        Terse proof for xlat_pe_in_pdir_range_TCC2.
                                                                                                                        xlat_pe_in_pdir_range_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{2}))

Repeatedly Skolemizing and flattening,

Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Instantiating quantified variables,

                                                                                                                        This completes the proof of xlat_pe_in_pdir_range_TCC2.

Q.E.D.

1677 C Proof scripts

C.117.41 Linear_Memory_Properties.xlat_pe_in_pdir_range_TCC3

                                                                                                                        Terse proof for xlat_pe_in_pdir_range_TCC3.

                                                                                                                        xlat_pe_in_pdir_range_TCC3:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

addr)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

addr)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

addr)`offset < max_linear_offset

Installing automatic rewrites from: (bits_per_level pe_size Mem max_linear < max_level)

Repeatedly Skolemizing and flattening,

Case splitting on OK?[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s2!1)),

we get 2 subgoals:

1678

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pdir_range_TCC3.1:

{-1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_idx_memory_address,

we get 2 subgoals:

1679 C Proof scripts

                                                                                                                        xlat_pe_in_pdir_range_TCC3.1.1:

{-1} aligned?(bits_per_level + pe_size) (offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃

xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

< max_linear

{-2} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_idx_memory_address2,

we get 2 subgoals:

1680

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pdir_range_TCC3.1.1.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃ 0 ≤ offset

(xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′))

{-2} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃ xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

< max_linear

{-3} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

1681 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.1.1.1.
xlat_pe_in_pdir_range_TCC3.1.1.2:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃ xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

< max_linear

{-2} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{1} pdir_lvl[Physical_memory, pm_phy] < 2

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_pe_in_pdir_range_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.1.1.2.

1682

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pdir_range_TCC3.1.2:

{-1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})
{1} pdir_lvl[Physical_memory, pm_phy] < 2

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_pe_in_pdir_range_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.1.2.

1683 C Proof scripts

xlat_pe_in_pdir_range_TCC3.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_pe_in_pdir_range_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.2.

Q.E.D.

C.117.42 Linear_Memory_Properties.xlat_pe_in_pdir_range

Terse proof for xlat_pe_in_pdir_range.

1684

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pdir_range:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Lin- ear_memory): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ pe_in_pdir_range?(s_{1}, restrict[Address, Memory_Address_4G, boolean] ((pm‘ro_addr∪ pm‘rw_addr))) (xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR) (s_{2}))`base_addr, addr))

Repeatedly Skolemizing and flattening, Expanding the definition of pe_in_pdir_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

xlat_pe_in_pdir_range.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{1} ∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))): xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

lin_a)

= xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

Instantiating the top quantifier in 1 with the terms: (addr!1), we get 2 subgoals:

xlat_pe_in_pdir_range.1.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{1} xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′) = xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr, addr′)

Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -9 with the terms: (s1!1 s2!1),

1685 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range.1.1.
xlat_pe_in_pdir_range.1.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})
{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(addr′)

Expanding the definition of restrict, which is trivially true.

This completes the proof of xlat_pe_in_pdir_range.1.2.
xlat_pe_in_pdir_range.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})
{1} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))

Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, This completes the proof of xlat_pe_in_pdir_range.2. Q.E.D.

C.117.43 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC1

Terse proof for xlat_pe_in_pt_range_TCC1.
xlat_pe_in_pt_range_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G,

s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): pm`states(s_{2}) ∧ pm`states(s_{1}) ∧ is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{1})) ∨ Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Instantiating quantified variables,

1686

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                            This completes the proof of xlat_pe_in_pt_range_TCC1.

Q.E.D.

C.117.44 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC2

                                                                                          Terse proof for xlat_pe_in_pt_range_TCC2.
                                                                                            xlat_pe_in_pt_range_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

pm`states(s_{2}) ∧

pm`states(s_{1}) ∧ is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{1}))

Repeatedly Skolemizing and flattening,

Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables,

                                                                                            This completes the proof of xlat_pe_in_pt_range_TCC2.

Q.E.D.

C.117.45 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC3

                                                                                          Terse proof for xlat_pe_in_pt_range_TCC3.
                                                                                            xlat_pe_in_pt_range_TCC3:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃ ptab_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening,

Keeping (2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                            This completes the proof of xlat_pe_in_pt_range_TCC3.

Q.E.D.

1687 C Proof scripts

C.117.46 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC4

                                                                                                                        Terse proof for xlat_pe_in_pt_range_TCC4.

1688

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range_TCC4:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃

Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2`offset

< max_linear_offset

1689 C Proof scripts

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: Mem max_linear < bits_per_level pe_size max_level

Using lemma xlat_pe_in_pt_range_TCC2,

Using lemma xlat_idx_memory_address,

Using lemma xlat_idx_memory_address2,

Using lemma translate_result_no_leaf,

Using lemma translate_memory_address,

Using lemma translate_memory_address2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range_TCC4.

Q.E.D.

C.117.47 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC5

                                                                                                                        Terse proof for xlat_pe_in_pt_range_TCC5.

1690

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range_TCC5:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃

Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2,

addr)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2,

addr)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2,

addr)`offset < max_linear_offset

1691 C Proof scripts

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: Mem max_linear < bits_per_level pe_size max_level

Using lemma xlat_idx_memory_address,

we get 3 subgoals:

1692

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range_TCC5.1:

{-1} aligned?(bits_per_level + pe_size) (offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃

xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{-9} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1693 C Proof scripts

Using lemma xlat_idx_memory_address2,

we get 3 subgoals:

1694

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range_TCC5.1.1:

{-1} aligned?(bits_per_level + pe_size) (offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃ 0 ≤ offset

(xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′))

{-2} aligned?(bits_per_level + pe_size) (offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃

xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})

{-10} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1695 C Proof scripts

Using lemma translate_result_leaf,

Using lemma translate_memory_address,

Using lemma translate_memory_address2,

Using lemma translate_result_no_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range_TCC5.1.1.

1696

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range_TCC5.1.2:

{-1} aligned?(bits_per_level + pe_size) (offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃

xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{-9} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

< max_linear_offset

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1697 C Proof scripts

Using lemma translate_memory_address,

Using lemma translate_memory_address2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range_TCC5.1.2.

1698

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range_TCC5.1.3:

{-1} aligned?(bits_per_level + pe_size) (offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃

xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{-9} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} ptab_lvl[Physical_memory, pm_phy] < 2

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1699 C Proof scripts

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range_TCC5.1.3.

1700

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pt_range_TCC5.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

< max_linear_offset

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1701 C Proof scripts

Using lemma translate_memory_address,

Using lemma translate_memory_address2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.2.

1702

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pt_range_TCC5.3:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} ptab_lvl[Physical_memory, pm_phy] < 2

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1703 C Proof scripts

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.3.

Q.E.D.

C.117.48 Linear_Memory_Properties.xlat_pe_in_pt_range

Terse proof for xlat_pe_in_pt_range.
xlat_pe_in_pt_range:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧ ¬ data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃ pe_in_pt_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s_{1}))`base_addr,

addr, access, priv) (state(read_data(pm_phy, pdbr_data_type)

(PDBR) (s_{1}))))`2,

addr))

Installing automatic rewrites from: (bits_per_level pe_size singleton has_next_state)

Repeatedly Skolemizing and flattening,

Expanding the definition of pe_in_pt_range?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

1704

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pt_range.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{-9} ptab_lvl = pdir_lvl

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)

(PDBR) (s′_{1}))))`2,

addr′))

Keeping (-9) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.1.

1705 C Proof scripts

xlat_pe_in_pt_range.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

Copying formula number: -5

Expanding the definition of is_linear_plain_memory?,

Applying disjunctive simplification to flatten sequent,

Hiding formulas: (-1 -2 -3 -5 -7 -8),

Case splitting on OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s1!1)), pm!1‘states (state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1))),

we get 3 subgoals:

1706

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                            xlat_pe_in_pt_range.2.1:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-4} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-8} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-9} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-10} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-11} Mem?(addr′`type_of)
{-12} 0 ≤ addr′`offset
{-13} addr′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-15} is_linear_plain_memory?(pm′)
{-16} pm′`states(s′_{1})
{-17} pm′`states(s′_{2})

{-18} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl
{3} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′)) 1707

C Proof scripts

Instantiating the top quantifier in -4 with the terms: (s2!1 state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1))),

we get 2 subgoals:

1708

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-4} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-8} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-9} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-10} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-11} Mem?(addr′`type_of)
{-12} 0 ≤ addr′`offset
{-13} addr′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-15} is_linear_plain_memory?(pm′)
{-16} pm′`states(s′_{1})
{-17} pm′`states(s′_{2})

{-18} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl
{3} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

1709 C Proof scripts

Applying disjunctive simplification to flatten sequent,

Replacing using formula -5,

Expanding the definition of pe_in_ptab_range?,

Case splitting on pe_in_pdir_range?[Physical_memory, pm_phy] (state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1)), restrict[Address, Memory_Address_4G, boolean] (union[Address](pm!1‘ro_addr, pm!1‘rw_addr))) (xlat_idx[Physical_memory, pm_phy] (pdir_lvl, data[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1))‘base_addr, addr!1)),

we get 3 subgoals:

1710

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl
{3} ∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1711 C Proof scripts

Instantiating the top quantifier in 3 with the terms: (xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s1!1))‘base_addr, addr!1)),

we get 2 subgoals:

1712

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl
{3} ∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl)) (xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1713 C Proof scripts

Instantiating the top quantifier in 3 with the terms: (addr!1),

we get 2 subgoals:

1714

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} OK?(read_data(pm_phy, paging_data_type(pdir_lvl)) (xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))),

addr′)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

1715 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

1716

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1.1.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))),

addr′)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, priv′)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

1717 C Proof scripts

Using lemma translate_result_as_read,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.1.1.

1718

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1.1.1.1.2:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))) {1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))))

1719 C Proof scripts

Expanding the definition of translate,

Installing automatic rewrites from: ( ##! fatal_result! raise_fault! exception_result! ok_result!)

Expanding the definition of paging_type?,

Expanding the definition of pdir_entry?,

Expanding the definition of present?,

Expanding the definition of is_leaf?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.1.2.

1720

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pt_range.2.1.1.1.1.1.3:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))))

∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

= (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} OK?(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′))

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

1721 C Proof scripts

Keeping (-20 3) and hiding *,

Expanding the definition of translate,

Installing automatic rewrites from: ( ##! fatal_result! raise_fault! exception_result! ok_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.1.3.

1722

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pt_range.2.1.1.1.1.2:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))))

∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

= (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(addr′)

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

1723 C Proof scripts

Expanding the definition of restrict,

which is trivially true.

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.2.

1724

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

xlat_pe_in_pt_range.2.1.1.1.2:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))))

∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

= (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})), restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

1725 C Proof scripts

which is trivially true.

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.2.

1726

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                            xlat_pe_in_pt_range.2.1.1.2:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-4} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-9} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-10} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-11} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-12} Mem?(addr′`type_of)
{-13} 0 ≤ addr′`offset
{-14} addr′`offset < max_linear_offset
{-15} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-16} is_linear_plain_memory?(pm′)
{-17} pm′`states(s′_{1})
{-18} pm′`states(s′_{2})

{-19} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl
{4} ∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1727 C Proof scripts

Hiding formulas: 4,

Using lemma xlat_pe_in_pdir_range,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range.2.1.1.2.

1728

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.1.1.3:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-4} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-9} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-10} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-11} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-12} Mem?(addr′`type_of)
{-13} 0 ≤ addr′`offset
{-14} addr′`offset < max_linear_offset
{-15} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-16} is_linear_plain_memory?(pm′)
{-17} pm′`states(s′_{1})
{-18} pm′`states(s′_{2})

{-19} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′)`offset < max_linear_offset

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl
{4} ∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1729 C Proof scripts

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Installing automatic rewrites from: max_linear < Mem <= min_linear Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of xlat_pe_in_pt_range.2.1.1.3.
                                                                                                                        xlat_pe_in_pt_range.2.1.2:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-7} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-8} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-9} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} is_linear_plain_memory?(pm′)
{-15} pm′`states(s′_{1})
{-16} pm′`states(s′_{2})

{-17} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pm′`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl
{4} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

which is trivially true.

                                                                                                                        This completes the proof of xlat_pe_in_pt_range.2.1.2.

1730

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.2:

{-1} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-2} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-3} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-7} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-8} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-9} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} is_linear_plain_memory?(pm′)
{-15} pm′`states(s′_{1})
{-16} pm′`states(s′_{2})

{-17} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl
{4} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′)) 1731

C Proof scripts

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers,

Expanding the definition of linear_resolve_register_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma unchanged_memory_invariant_invariant,

Using lemma expr_transformer_invariant_next_ok,

Using lemma pm_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.2.

1732

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

                                                                                                                        xlat_pe_in_pt_range.2.3:

{-1} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-2} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-6} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-7} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-8} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-9} Mem?(addr′`type_of)
{-10} 0 ≤ addr′`offset
{-11} addr′`offset < max_linear_offset
{-12} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-13} is_linear_plain_memory?(pm′)
{-14} pm′`states(s′_{1})
{-15} pm′`states(s′_{2})

{-16} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl
{4} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

1733 C Proof scripts

Instantiating quantified variables,

This completes the proof of xlat_pe_in_pt_range.2.3.

Q.E.D.

C.117.49

Linear_Memory_Properties.linear_resolve_unchanged_pm_phy

                                                                                                                        Terse proof for linear_resolve_unchanged_pm_phy.
                                                                                                                        linear_resolve_unchanged_pm_phy:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

addr: Memory_Address_4G, access: Memory_access): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm`states,

singleton(expr_2_super[Physical_memory, Address](linear_resolve(addr, ac-

cess))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s, restrict [Address, Memory_Address_4G , boolean]((pm‘ro_addr∪ pm‘rw_addr))))))

Installing automatic rewrites from: plain_memory_unchanged_memory_ok_result

Repeatedly Skolemizing and flattening,

Letting addresses name difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr), extend[Address, Memory_Address_4G, bool, FALSE] (address_in_pt_range?(s!1, restrict [Address, Memory_Address_4G, boolean] (union (pm!1‘ro_addr, pm!1‘rw_addr))))),

Replacing using formula -1,

Case splitting on subset?(addresses, union(pm_phy‘ro_addr, pm_phy‘rw_addr)),

we get 2 subgoals:

                                                                                                                        linear_resolve_unchanged_pm_phy.1:

{-1} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)

{1} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(addr′, access′))), addresses)

Expanding the definition of linear_resolve,

Using lemma pm_plain_phy, Using lemma pm_states, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Installing automatic rewrites from: (has_next_state! max_level! bits_per_level! bus_width! pe_size!

singleton! <! Mem! max_linear!) Copying formula number: -9 Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent,

1734

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Installing automatic rewrites from: pdir_lvl!! ptab_lvl!!

Case splitting on FORALL (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool, base: {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl[Physical_memory, pm_phy] * bits_per_level [Physical_memory, pm_phy]) - bits_per_level [Physical_memory, pm_phy] + bus_width) (offset(b)) ELSE aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size) (offset(b)) ENDIF}): NOT leaf IMPLIES (FORALL (x1: Physical_memory): every[Physical_memory, [bool, Address]] (LAMBDA (x: Physical_memory): TRUE, LAMBDA (t: [bool, Address]): Mem?(t‘2‘type_of) AND 0 <= t‘2‘offset AND t‘2‘offset < max_linear_offset) (translate[Physical_memory, pm_phy] (1, base, addr!1, access!1, segment_to_priv(cs))(x1))), FORALL (cs: Segment_Reg_type, pdbr: Pdbr_type): FORALL (x1: Physical_memory): every[Physical_memory, [bool, Address]] (LAMBDA (x: Physical_memory): TRUE, LAMBDA (t: [bool, Address]): Mem?(t‘2‘type_of) AND (0 <= t‘2‘offset AND t‘2‘offset < max_linear_offset) AND IF t‘1 THEN aligned?(22)(offset(t‘2)) ELSE aligned?(12)(offset(t‘2)) ENDIF) (translate[Physical_memory, pm_phy] (0, pdbr‘base_addr, addr!1, access!1, segment_to_priv(cs)) (x1)),

we get 5 subgoals:

1735 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} unchanged_memory_invariant?[Physical_memory] (pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′)) else (translate(ptab_lvl,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(ptab_lvl, base_1, addr′))))

endif)))))))),

addresses)

1736

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Rewriting using plain_memory_unchanged_composition [Physical_memory, Segment_Reg_type, Address], matching in * where P gets LAMBDA (t: Segment_Reg_type): FORALL (s: (pm!1‘states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) AND t = data(read_data(pm_phy, segment_reg_data_type)(CS)(s)),

we get 3 subgoals:

1737 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.1:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s_1)) ⊃

(∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧ data(read_data(pm_phy, segment_reg_data_type)(CS)(s_1)) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s)))

{2} unchanged_memory_invariant?[Physical_memory] (pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(0, base, addr′)) else (translate(1,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(1, base_1, addr′))))

endif)))))))),

addresses)

1738

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Keeping (-7 -8 1) and hiding *,

Instantiating quantified variables,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_unchanged_pm_phy.1.1.1.

1739 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.2:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(read_data(pm_phy, seg-

ment_reg_data_type)

(CS))),

addresses)

{2} unchanged_memory_invariant?[Physical_memory] (pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(0, base, addr′)) else (translate(1,

base, addr′, access′, seg-

ment_to_priv(cs))

##

(λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(1, base_1, addr′))))

endif)))))))),

addresses)

1740

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers,

Expanding the definition of linear_resolve_register_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma unchanged_memory_invariant_mono,

Rewriting using subset_reflexive, matching in *,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.2.

1741 C Proof scripts

linear_resolve_unchanged_pm_phy.1.1.3:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]]

(λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃ (∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]]

(λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧ pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} ∀ (d:

(λ (t: Segment_Reg_type):

∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧ t = data(read_data(pm_phy, segment_reg_data_type)(CS)(s)))):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)

(PDBR)

## (λ

(pdbr: Pdbr_type): (translate

(0, pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf then ok_result

(xlat_ofs

(0, base, addr′)) else (translate

(1, base, addr′, access′, seg-

ment_to_priv(d)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs

(1, base_1, addr′))))

endif)))))),

addresses)

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(0, pdbr`base_addr, addr′, access′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(0, base, addr′)) else (translate(1,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(1, base_1, addr′))))

endif)))))))),

addresses)

1742

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_unchanged_composition[Physical_memory, Pdbr_type, Address], matching in * where P gets LAMBDA (base: Pdbr_type): FORALL (s: (pm_phy‘states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) AND data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = base,

we get 5 subgoals:

1743 C Proof scripts

linear_resolve_unchanged_pm_phy.1.1.3.1:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧ d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]]

(λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃ (∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]]

(λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧ pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_1)) ⊃ (∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧ data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_1)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type):

(translate

(0, pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf then ok_result

(xlat_ofs

(0, base, addr′)) else (translate

(1, base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs

(1, base_1, addr′))))

endif)))))),

addresses)

1744

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-7 -8 1) and hiding *,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.1.

1745 C Proof scripts

linear_resolve_unchanged_pm_phy.1.1.3.2:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(read_data(pm_phy, pdbr_data_type)

(PDBR))),

addresses)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1746

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers,

Expanding the definition of linear_resolve_register_transformers,

Using lemma unchanged_memory_invariant_mono,

Rewriting using subset_reflexive, matching in *,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                            This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.2.

1747 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)
{1} ∀ (d:

(λ (base: Pdbr_type):

∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧ data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = base)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1748

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_unchanged_composition [Physical_memory, [leaf: bool, {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl * bits_per_level) - bits_per_level + bus_width) (offset(b)) ELSE aligned?(bits_per_level + pe_size)(offset(b)) ENDIF}], Address], matching in * where P gets LAMBDA (d: [leaf: bool, {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl * bits_per_level) - bits_per_level + bus_width) (offset(b)) ELSE aligned?(bits_per_level + pe_size)(offset(b)) ENDIF}]): FORALL (s: (pm_phy‘states)): OK?(translate(0, d!2‘base_addr, addr!1, access!1, segment_to_priv(d!1)) (s)) AND d = data(translate(0, d!2‘base_addr, addr!1, access!1, segment_to_priv(d!1)) (s)),

we get 4 subgoals:

1749 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3.1:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s_1)) ⊃ (∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s_1)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ (leaf: bool,

base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

1750

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Case splitting on pe_in_pt_range?(s!2, restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)), 0) (xlat_idx(0, d!2‘base_addr, addr!1)),

we get 3 subgoals:

1751 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3.1.1:

{-1} pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0, d′′`base_addr, addr′))

{-2} pm_phy`states(s′′′)
{-3} pm_phy`states(s′′)
{-4} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))

{-5} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-6} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-17} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-18} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-19} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-20} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-21} pm′`states = pm_phy`states
{-22} plain_memory?(pm_phy)
{-23} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-24} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-25} Mem?(addr′`type_of)
{-26} 0 ≤ addr′`offset
{-27} addr′`offset < max_linear_offset
{-28} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-29} is_linear_plain_memory?(pm′)
{-30} pm_phy`states(s′)

{1} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′))

1752

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma translate_same_result,

Using lemma translate_result_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.1.

1753 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3.1.2:

{-1} pm_phy`states(s′′′)
{-2} pm_phy`states(s′′)
{-3} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-5} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-8} pm′`mem = linear_pm
{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-17} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-18} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-19} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-20} pm′`states = pm_phy`states
{-21} plain_memory?(pm_phy)
{-22} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-23} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-28} is_linear_plain_memory?(pm′)
{-29} pm_phy`states(s′)

{1} pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0, d′′`base_addr, addr′)) {2} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′)) ∧

data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′))

1754

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Expanding the definition of pe_in_pt_range?,

Expanding the definition of pe_in_pdir_range?,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Instantiating the top quantifier in 1 with the terms: addr′,

we get 2 subgoals:

1755 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.1:

{-1} 0 = 0
{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))
{-3} pm_phy`states(s′′′)
{-4} pm_phy`states(s′′)
{-5} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))
{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′
{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

((λ (phy_a: Memory_Address_4G):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

lin_a)

= phy_a))

=

(λ (phy_a: Memory_Address_4G): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

lin_a)

= phy_a)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′) = xlat_idx(0, d′′`base_addr, addr′)

1756

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.1.

1757 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.2:

{-1} 0 = 0
{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))
{-3} pm_phy`states(s′′′)
{-4} pm_phy`states(s′′)
{-5} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))
{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′
{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

((λ (phy_a: Memory_Address_4G):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

lin_a)

= phy_a))

=

(λ (phy_a: Memory_Address_4G): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

lin_a)

= phy_a)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(addr′)

1758

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-29 1) and hiding *,

Expanding the definition of restrict,

which is trivially true.

                                                                                                                        This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.2.

1759 C Proof scripts

                                                                                                                        linear_resolve_unchanged_pm_phy.1.1.3.3.1.3:

{-1} pm_phy`states(s′′′)
{-2} pm_phy`states(s′′)
{-3} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-5} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-8} pm′`mem = linear_pm
{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

                                                                                                                        a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-17} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-18} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-19} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-20} pm′`states = pm_phy`states
{-21} plain_memory?(pm_phy)
{-22} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-23} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-28} is_linear_plain_memory?(pm′)
{-29} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset

{2} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′))

1760

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2,

Using lemma xlat_idx_memory_address,

Using lemma xlat_idx_memory_address2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.3.

1761 C Proof scripts

linear_resolve_unchanged_pm_phy.1.1.3.3.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧ data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧ d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]]

(λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃ (∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]]

(λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧ pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

a:

(pe_in_pt_range?(s, rest

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma translate_memory_address2,

we get 2 subgoals:

2061 C Proof scripts

linear_resolve_same_page_address_ok.2.1.3.1.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ 0 ≤ offset

(data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`2)

{-2} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))))`2

< max_linear

{-3} (addr′ + delta′)`offset < max_linear_offset
{-4} 0 ≤ (addr′ + delta′)`offset

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} delta′ ≥ 0
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-15} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-16} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2062

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.2.1.3.1.1.

2063 C Proof scripts

linear_resolve_same_page_address_ok.2.1.3.1.2:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))))`2

< max_linear

{-2} (addr′ + delta′)`offset < max_linear_offset
{-3} 0 ≤ (addr′ + delta′)`offset

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} delta′ ≥ 0
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-14} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-15} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} 0 ≤ (addr′ + delta′)`offset ∧ (addr′ + delta′)`offset < max_linear_offset

{2} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{4} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2064

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_same_page_address_ok.2.1.3.1.2.

2065 C Proof scripts

linear_resolve_same_page_address_ok.2.1.3.2:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} 0 ≤ (addr′ + delta′)`offset ∧ (addr′ + delta′)`offset < max_linear_offset

{2} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{4} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2066

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_same_page_address_ok.2.1.3.2.

2067 C Proof scripts

linear_resolve_same_page_address_ok.2.1.4:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} OK?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2068

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_same_page_address_ok.2.1.4.

2069 C Proof scripts

linear_resolve_same_page_address_ok.2.1.5:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} OK?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))))

∨ Exception?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2070

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.2.1.5.

2071 C Proof scripts

linear_resolve_same_page_address_ok.2.1.6:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} 0 ≤ (addr′ + delta′)`offset ∧ (addr′ + delta′)`offset < max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2072

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_same_page_address_ok.2.1.6.

2073 C Proof scripts

linear_resolve_same_page_address_ok.2.1.7:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′, ac′, segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2074

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (2 3),

Using lemma translate_memory_address,

Using lemma translate_memory_address2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.2.1.7.

2075 C Proof scripts

linear_resolve_same_page_address_ok.2.2:

{-1} 0 ≤ (addr′ + delta′)`offset

{-2} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} delta′ ≥ 0
{-8} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-12} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-13} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} (addr′ + delta′)`offset < max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2076

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-4 -5 -6 -8 1) and hiding *,

Rewriting using delta_memory_address, matching in *,

This completes the proof of linear_resolve_same_page_address_ok.2.2.

2077 C Proof scripts

linear_resolve_same_page_address_ok.2.3:

{-1} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-2} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

= translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-8} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-10} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-11} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-12} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)

(PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))`2,

addr′, ac′, segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))`base_addr,

addr′, ac′, segment_to_priv(data

(read_data

(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))`2,

addr′)))

{1} 0 ≤ (addr′ + delta′)`offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′, segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf: bool,

base:

{b: Memory_Address_4G |

if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size)

(offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

## (λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2078

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-3 -4 -6 1) and hiding *, Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.2.3.

Q.E.D.

C.117.67 Linear_Memory_Properties.linear_resolve_same_page_address_TCC1

Terse proof for linear_resolve_same_page_address_TCC1.
linear_resolve_same_page_address_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], addr: Mem-

ory_Address_4G, δ: nat,

ac: Memory_access): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ∧ OK?(linear_resolve(addr, ac)(s)) ⊃ OK?[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](addr + δ, ac)(s))

Repeatedly Skolemizing and flattening, Rewriting using linear_resolve_same_page_address_ok, matching in *,

This completes the proof of linear_resolve_same_page_address_TCC1.

Q.E.D.

C.117.68 Linear_Memory_Properties.linear_resolve_same_page_address

The L^{A}TEX code for this proof is broken.

C.117.69 Linear_Memory_Properties.address_block_split_type

Terse proof for address_block_split_type.
address_block_split_type:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: list[Byte]): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every(λ (t: [Address, list[Byte]]): Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma split_type, Using lemma address_block_in_memory, Using lemma address_block_in_memory2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

2079 C Proof scripts

                                                                                                                   address_block_split_type.1:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{1} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Hiding formulas: (-8),

Using lemma every_implied,

we get 2 subgoals:

2080

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

address_block_split_type.1.1:

{-1} (∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ⊃ Mem?(t_1`1`type_of) ∧ 0 ≤ t_1`1`offset ∧ t_1`1`offset < max_linear_offset)

∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} 0 ≤ a′`offset
{-5} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{-6} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} a′`offset < max_linear_offset

{1} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Keeping (-1 -2 -3 1) and hiding *,

Installing automatic rewrites from: (max_linear! Mem!)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_split_type.1.1.

2081 C Proof scripts

address_block_split_type.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} a′`offset < max_linear_offset

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of) {2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of address_block_split_type.1.2.
address_block_split_type.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-5} Mem?(a′`type_of)
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Keeping (-3 -5 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_split_type.2.

2082

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

address_block_split_type.3:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} Mem?(a′`type_of)
{-5} a′`offset < max_linear_offset

{-6} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{1} cons?(bl′)
{2} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Using lemma split_null, Keeping (-1 1 3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_split_type.3.

Q.E.D.

C.117.70 Linear_Memory_Properties.same_page_address_block_read_TCC1

Terse proof for same_page_address_block_read_TCC1.
same_page_address_block_read_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

⊃ OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a_{2}, Read)(s))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_resolve_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read_TCC1.

Q.E.D.

C.117.71 Linear_Memory_Properties.same_page_address_block_read

Terse proof for same_page_address_block_read.

2083 C Proof scripts

same_page_address_block_read:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

⊃ (address_block(data(linear_resolve(a_{2}, Read)(s)), s_{2}) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Installing automatic rewrites from: singleton member subset? Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-4 -6 -7 -8 -9), Instantiating the top quantifier in -3 with the terms: (a2!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

same_page_address_block_read.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} OK?(linear_resolve(a′_{2}, Read)(s′))
{-4} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{1} ∀ (x: Address):

address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

2084

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly Skolemizing and flattening,

Case splitting on offset(x!1) - offset (data[Physical_memory, Address] (linear_resolve[Physical_memory, pm_phy](a2!1, Read)(s!1))) >= 0,

we get 2 subgoals:

same_page_address_block_read.1.1:

{-1} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} OK?(linear_resolve(a′_{2}, Read)(s′))
{-5} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-6} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-7} Mem?(a′_{1}`type_of)
{-8} 0 ≤ a′_{1}`offset
{-9} a′_{1}`offset < max_linear_offset
{-10} Mem?(a′_{2}`type_of)
{-11} 0 ≤ a′_{2}`offset
{-12} a′_{2}`offset < max_linear_offset
{-13} s′_{1} > 0
{-14} s′_{2} > 0
{-15} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-16} a′_{1} ≤ a′_{2}
{-17} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-18} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-19} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-20} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Using lemma linear_resolve_same_page_address,

Case splitting on rem(expt(2, min_page))(offset(a2!1)) + offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1))) < expt(2, min_page),

we get 2 subgoals:

2085 C Proof scripts

same_page_address_block_read.1.1.1:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page) {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page) ∧ OK?(linear_resolve(a′_{2}, Read)(s′)) ⊃ data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(a′_{2}, Read)(s′))
{-7} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-22} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Case splitting on data(linear_resolve(a2!1, Read)(s!1)) + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1)))) = x!1,

we get 2 subgoals:

2086

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_read.1.1.1.1:

{-1} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= x′ {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Read)(s′))

{-4} data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-5} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)
{-8} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-9} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Replacing using formula -1,

Replacing using formula -4,

Case splitting on OK?(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1)))), Read) (s!1)),

we get 2 subgoals:

2087 C Proof scripts

same_page_address_block_read.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-10} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-11} Mem?(a′_{1}`type_of)
{-12} 0 ≤ a′_{1}`offset
{-13} a′_{1}`offset < max_linear_offset
{-14} Mem?(a′_{2}`type_of)
{-15} 0 ≤ a′_{2}`offset
{-16} a′_{2}`offset < max_linear_offset
{-17} s′_{1} > 0
{-18} s′_{2} > 0
{-19} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-20} a′_{1} ≤ a′_{2}
{-21} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-22} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-23} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-24} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Instantiating the top quantifier in -10 with the terms: (data(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1)))), Read) (s!1))),

we get 2 subgoals:

2088

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_read.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-10} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′)))

⇒ restrict[Address, Memory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)) (data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′)))

{-11} Mem?(a′_{1}`type_of)
{-12} 0 ≤ a′_{1}`offset
{-13} a′_{1}`offset < max_linear_offset
{-14} Mem?(a′_{2}`type_of)
{-15} 0 ≤ a′_{2}`offset
{-16} a′_{2}`offset < max_linear_offset
{-17} s′_{1} > 0
{-18} s′_{2} > 0
{-19} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-20} a′_{1} ≤ a′_{2}
{-21} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-22} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-23} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-24} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

2089 C Proof scripts

Expanding the definition of restrict, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of virt_to_phys_range, Instantiating the top quantifier in 1 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1,

Read)(s!1)))) Read), we get 3 subgoals:

same_page_address_block_read.1.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

which is trivially true.

2090

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

This completes the proof of same_page_address_block_read.1.1.1.1.1.1.1.
same_page_address_block_read.1.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union[Memory_access]

(singleton[Memory_access](Read), singleton[Memory_access](Execute))(Read)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Using lemma linear_resolve_same_page_address_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of union,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.1.1.2.

2091 C Proof scripts

same_page_address_block_read.1.1.1.1.1.1.3:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union[Memory_Address_4G]

(λ (s: Memory_Address_4G): pm′`ro_addr(s),

λ (s: Memory_Address_4G): pm′`rw_addr(s)) (a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Instantiating the top quantifier in -22 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1))))),

Hiding formulas: (-3 -4 -6 -9 2), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.1.1.3.

2092

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_read.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))),

Read) (s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))),

Read) (s′))`offset

∧ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))),

Read) (s′))`offset

< max_linear_offset

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

2093 C Proof scripts

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.1.2.
same_page_address_block_read.1.1.1.1.2:

{-1} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Read)(s′))

{-4} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-5} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)
{-8} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-9} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

2094

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma linear_resolve_same_page_address_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.2.
same_page_address_block_read.1.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-2} OK?(linear_resolve(a′_{2}, Read)(s′))

{-3} data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-4} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)
{-7} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-22} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)

{1} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= x′

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Expanding the definition of +,

Applying decompose-equality,

Expanding the definition of address_block,

which is trivially true.

This completes the proof of same_page_address_block_read.1.1.1.2.

2095 C Proof scripts

same_page_address_block_read.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page) ∧ OK?(linear_resolve(a′_{2}, Read)(s′)) ⊃ data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-2} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(a′_{2}, Read)(s′))
{-6} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-21} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)

{1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.2.

2096

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_read.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} OK?(linear_resolve(a′_{2}, Read)(s′))
{-4} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-19} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)

{1} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.1.2.

2097 C Proof scripts

same_page_address_block_read.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-4} Mem?(a′_{1}`type_of)
{-5} 0 ≤ a′_{1}`offset
{-6} a′_{1}`offset < max_linear_offset
{-7} Mem?(a′_{2}`type_of)
{-8} 0 ≤ a′_{2}`offset
{-9} a′_{2}`offset < max_linear_offset
{-10} s′_{1} > 0
{-11} s′_{2} > 0
{-12} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-13} a′_{1} ≤ a′_{2}
{-14} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-15} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-16} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{1} union(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)) (a′_{2})

{2} ∀ (x: Address):

address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

Keeping (-12 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.2.

Q.E.D.

C.117.72 Linear_Memory_Properties.same_page_address_block_write_TCC1

Terse proof for same_page_address_block_write_TCC1.

2098

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ pm‘rw_addr)

⊃

OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a_{2}, Write)(s))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_resolve_write_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_write_TCC1.

Q.E.D.

C.117.73 Linear_Memory_Properties.same_page_address_block_write

Terse proof for same_page_address_block_write.
same_page_address_block_write:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ pm‘rw_addr)

⊃ (address_block(data(linear_resolve(a_{2}, Write)(s)), s_{2}) ⊆ pm_phy‘rw_addr)

Installing automatic rewrites from: singleton member subset? Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-3 -5 -7 -8 -9), Instantiating the top quantifier in -3 with the terms: (a2!1), Repeatedly Skolemizing and flattening, Case splitting on offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1))) >= 0, we get 2 subgoals:

2099 C Proof scripts

                                                                                                                   same_page_address_block_write.1:

{-1} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)

{-4} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} pm′`rw_addr(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-19} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Using lemma linear_resolve_same_page_address,

Case splitting on rem(expt(2, min_page))(offset(a2!1)) + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))) < expt(2, min_page),

we get 2 subgoals:

2100

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write.1.1:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

< expt(2, min_page) {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page) ∧ OK?(linear_resolve(a′_{2}, Write)(s′)) ⊃ data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} pm′`rw_addr(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-21} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2101 C Proof scripts

same_page_address_block_write.1.1.1:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-2} OK?(linear_resolve(a′_{2}, Write)(s′))

{-3} data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-4} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)

{-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} pm′`rw_addr(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-21} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Case splitting on data(linear_resolve(a2!1, Write)(s!1)) + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))) = x!1,

we get 2 subgoals:

2102

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write.1.1.1.1:

{-1} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

= x′ {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Write)(s′))

{-4} data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-5} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Replacing using formula -1,

Replacing using formula -4,

Case splitting on OK?(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))), Write) (s!1)),

we get 2 subgoals:

2103 C Proof scripts

same_page_address_block_write.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)

{-9} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} pm′`rw_addr(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-23} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Instantiating the top quantifier in -9 with the terms: (data(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))), Write) (s!1))),

we get 2 subgoals:

2104

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)

{-9} virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′)))

⇒ restrict[Address, Memory_Address_4G, boolean]

(pm_phy`rw_addr) (data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′)))

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} pm′`rw_addr(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-23} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

2105 C Proof scripts

Expanding the definition of restrict, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of virt_to_phys_range, Instantiating the top quantifier in 1 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1,

Write)(s!1)))) Write), we get 2 subgoals:

same_page_address_block_write.1.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

which is trivially true.

This completes the proof of same_page_address_block_write.1.1.1.1.1.1.1.

2106

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write.1.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} pm′`rw_addr

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))))

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Instantiating the top quantifier in -21 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1))))),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_write.1.1.1.1.1.1.2.

2107 C Proof scripts

same_page_address_block_write.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))),

Write) (s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))),

Write) (s′))`offset

∧ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))),

Write) (s′))`offset

< max_linear_offset

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

2108

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_write.1.1.1.1.1.2.
same_page_address_block_write.1.1.1.1.2:

{-1} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Write)(s′))

{-4} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-5} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Using lemma linear_resolve_same_page_address_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2109 C Proof scripts

This completes the proof of same_page_address_block_write.1.1.1.1.2.

same_page_address_block_write.1.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-2} OK?(linear_resolve(a′_{2}, Write)(s′))

{-3} data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

= data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-4} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)

{-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} pm′`rw_addr(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-21} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)

{1} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

= x′

{2} pm_phy`rw_addr(x′)

Expanding the definition of +,

Applying decompose-equality,

Expanding the definition of address_block,

which is trivially true.

This completes the proof of same_page_address_block_write.1.1.1.2.

2110

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-2} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} pm′`rw_addr(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-19} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} OK?(linear_resolve(a′_{2}, Write)(s′))
{2} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2})
{3} pm_phy`rw_addr(x′)

Expanding the definition of restrict,

which is trivially true.

This completes the proof of same_page_address_block_write.1.1.2.

2111 C Proof scripts

same_page_address_block_write.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page) ∧ OK?(linear_resolve(a′_{2}, Write)(s′)) ⊃ data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-2} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-6} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-7} Mem?(a′_{1}`type_of)
{-8} 0 ≤ a′_{1}`offset
{-9} a′_{1}`offset < max_linear_offset
{-10} Mem?(a′_{2}`type_of)
{-11} 0 ≤ a′_{2}`offset
{-12} a′_{2}`offset < max_linear_offset
{-13} s′_{1} > 0
{-14} s′_{2} > 0
{-15} pm′`rw_addr(a′_{2})
{-16} a′_{1} ≤ a′_{2}
{-17} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-18} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-19} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-20} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)

{1} rem(expt(2, min_page))(offset(a′_{2})) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

< expt(2, min_page)

{2} pm_phy`rw_addr(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_write.1.2.

2112

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

same_page_address_block_write.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-4} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-5} Mem?(a′_{1}`type_of)
{-6} 0 ≤ a′_{1}`offset
{-7} a′_{1}`offset < max_linear_offset
{-8} Mem?(a′_{2}`type_of)
{-9} 0 ≤ a′_{2}`offset
{-10} a′_{2}`offset < max_linear_offset
{-11} s′_{1} > 0
{-12} s′_{2} > 0
{-13} pm′`rw_addr(a′_{2})
{-14} a′_{1} ≤ a′_{2}
{-15} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-16} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-17} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-18} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{2} pm_phy`rw_addr(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_write.2.

Q.E.D.

C.117.74 Linear_Memory_Properties.split_linear_read_side_effects_states_TCC1

Terse proof for split_linear_read_side_effects_states_TCC1.
split_linear_read_side_effects_states_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states_TCC1.

Q.E.D.

2113 C Proof scripts

C.117.75 Linear_Memory_Properties.split_linear_read_side_effects_states

Terse proof for split_linear_read_side_effects_states.
split_linear_read_side_effects_states:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e)))))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

split_linear_read_side_effects_states.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Using lemma every_conjunct_left,

2114

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma every_conjunct_left,

we get 3 subgoals:

2115 C Proof scripts

split_linear_read_side_effects_states.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2116

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma every_conjunct_left,

we get 3 subgoals:

2117 C Proof scripts

split_linear_read_side_effects_states.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2118

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: max_linear Mem min_linear Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of transformer_invariant?, Expanding the definition of linear_read_side_effect_in_page, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -9, Hiding formulas: -9, Installing automatic rewrites from: (result_pred! has_next_state! ##! expr_2_super!

expr_2_super_res!)

Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(t!1‘1), we get 2 subgoals:

split_linear_read_side_effects_states.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} pm′`states(s′)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma pm_linear_resolve_read_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Read)(s!1)), length(t!1‘2)),

union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 3 subgoals:

2119 C Proof scripts

                                                                                                                   split_linear_read_side_effects_states.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma linear_resolve_states,

Using lemma pm_states,

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2120

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.1.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(t′`1, Read)(s′))
{-7} pm_phy`states(state(linear_resolve(t′`1, Read)(s′)))
{-8} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} OK?(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} pm′`states

(state(memory_read_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformer_invariant_read_side_effects,

Using lemma super_transformer_invariant_next_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of memory_read_side_effect_super_transformers,

Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Read)(s!1)) t!1‘2 TRUE),

Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.1.1.

2121 C Proof scripts

split_linear_read_side_effects_states.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(t′`1, Read)(s′))
{-7} pm_phy`states(state(linear_resolve(t′`1, Read)(s′)))
{-8} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} Exception?(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} pm′`states

(state(memory_read_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformers_ok_read_side_effects_block,

Using lemma super_transformers_ok_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of memory_read_side_effect_super_transformers,

Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Read)(s!1)) t!1‘2 TRUE),

Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.1.2.

2122

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: 2,

Using lemma same_page_address_block_read,

we get 3 subgoals:

2123 C Proof scripts

split_linear_read_side_effects_states.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ union(pm′`ro_addr, pm′`rw_addr)(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

⊃ (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.2.1.
split_linear_read_side_effects_states.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2124

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.2.2.
split_linear_read_side_effects_states.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.2.3.
split_linear_read_side_effects_states.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Read)(s′))

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

2125 C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.3.

split_linear_read_side_effects_states.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-8} pm′`states(s′)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)

(ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: (-7 -13 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.2.

2126

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2)

⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2127 C Proof scripts

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.1.2.

2128

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2129 C Proof scripts

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.1.3.
split_linear_read_side_effects_states.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.2.

2130

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.3.

2131 C Proof scripts

split_linear_read_side_effects_states.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -6,

Expanding the definition of subset?,

Installing automatic rewrites from: Mem max_linear bus_width min_linear

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.2.

2132

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of min_linear, Expanding the definition of Mem, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_read_side_effects_states.3.

Q.E.D.

C.117.76 Linear_Memory_Properties.split_linear_write_side_effects_states_TCC1

Terse proof for split_linear_write_side_effects_states_TCC1.
split_linear_write_side_effects_states_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ⊃ every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-7 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets

pm!1‘rw_addr, c gets union(pm!1‘ro_addr, pm!1‘rw_addr),

2133 C Proof scripts

Keeping (1) and hiding *,

Rewriting using union_commutative, matching in *,

Rewriting using union_subset1, matching in *,

This completes the proof of split_linear_write_side_effects_states_TCC1.

Q.E.D.

C.117.77 Linear_Memory_Properties.split_linear_write_side_effects_states

Terse proof for split_linear_write_side_effects_states.
split_linear_write_side_effects_states:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states,

singleton(expr_2_super(linear_write_side_effect_in_page

(e)))))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening,

Using lemma split_range,

Using lemma split_no_null,

Using lemma split_type,

Using lemma split_pair_cross_size,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

2134

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

2135 C Proof scripts

split_linear_write_side_effects_states.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2136

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma every_conjunct_left,

we get 3 subgoals:

2137 C Proof scripts

split_linear_write_side_effects_states.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2138

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: (min_linear! max_linear! Mem!) Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of transformer_invariant?, Expanding the definition of linear_write_side_effect_in_page, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -9, Hiding formulas: -9, Installing automatic rewrites from: (result_pred! has_next_state! ##! expr_2_super!

expr_2_super_res!)

Case splitting on pm!1‘rw_addr(t!1‘1), we get 2 subgoals:

split_linear_write_side_effects_states.1.1.1.1:

{-1} pm′`rw_addr(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} pm′`states(s′)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma pm_linear_resolve_write_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Write)(s!1)), length(t!1‘2)),

pm_phy‘rw_addr), we get 3 subgoals:

2139 C Proof scripts

                                                                                                                   split_linear_write_side_effects_states.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma linear_resolve_states,

Using lemma pm_states,

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

2140

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-7} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-8} pm′`rw_addr(t′`1)
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} pm′`states

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformer_invariant_write_side_effects,

Using lemma super_transformer_invariant_next_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of memory_write_side_effect_super_transformers,

Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Write)(s!1)) t!1‘2 TRUE),

Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.1.

2141 C Proof scripts

split_linear_write_side_effects_states.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-7} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-8} pm′`rw_addr(t′`1)
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} Exception?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} pm′`states

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformers_ok_write_side_effects_block,

Using lemma super_transformers_ok_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of memory_write_side_effect_super_transformers,

Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Write)(s!1)) t!1‘2 TRUE),

Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.2.

2142

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-15} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-16} Mem?(a′`type_of)
{-17} 0 ≤ a′`offset
{-18} a′`offset < max_linear_offset
{-19} cons?[Byte](bl′)
{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} pm′`states

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Keeping (-7 1) and hiding *,

Rewriting using union_right, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.3.

2143 C Proof scripts

split_linear_write_side_effects_states.1.1.1.1.1.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-15} Exception?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-16} Mem?(a′`type_of)
{-17} 0 ≤ a′`offset
{-18} a′`offset < max_linear_offset
{-19} cons?[Byte](bl′)
{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} pm′`states

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Rewriting using union_right, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.4.

2144

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: 2,

Using lemma same_page_address_block_write,

we get 3 subgoals:

2145 C Proof scripts

split_linear_write_side_effects_states.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`rw_addr(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

⊃ (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.2.1.
split_linear_write_side_effects_states.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2146

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.2.2.
split_linear_write_side_effects_states.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.2.3.
split_linear_write_side_effects_states.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Write)(s′))

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

2147 C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.3.

split_linear_write_side_effects_states.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-8} pm′`states(s′)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} pm′`rw_addr(t′`1)

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)

(ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: (-7 -13 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.2.

2148

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2)

⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2149 C Proof scripts

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.1.2.

2150

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2151 C Proof scripts

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.1.3.
split_linear_write_side_effects_states.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.2.

2152

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.3.

2153 C Proof scripts

split_linear_write_side_effects_states.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -6,

Expanding the definition of subset?,

Installing automatic rewrites from: Mem max_linear bus_width min_linear

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.2.

2154

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of min_linear, Expanding the definition of Mem, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_write_side_effects_states.3.

Q.E.D.

C.117.78 Linear_Memory_Properties.split_linear_read_side_effects_ok

Terse proof for split_linear_read_side_effects_ok.
split_linear_read_side_effects_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s))) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem!! max_linear!! min_linear!! Using lemma split_range, Using lemma split_no_null, Using lemma split_type,

2155 C Proof scripts

Using lemma split_pair_cross_size,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

split_linear_read_side_effects_ok.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-12} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

2156

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2157 C Proof scripts

Using lemma every_conjunct_left,

we get 3 subgoals:

2158

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): (cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-15} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2159 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: (-1 -3 -4 -5 -6 -7 -11),

Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res!)

Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], we get 3 subgoals:

                                                                                                                   split_linear_read_side_effects_ok.1.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Using lemma every_implied,

we get 3 subgoals:

2160

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.1.1.1.1.1:

{-1} (∀ (t: [Memory_Address_4G, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page)

⊃ OK?(linear_read_side_effect_in_page(t)(s′))) ∧ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} cons?[Byte](bl′)
{-8} is_linear_plain_memory?(pm′)
{-9} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-10} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2161 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: (-1 -2 2),

Expanding the definition of linear_read_side_effect_in_page,

Repeatedly Skolemizing and flattening,

Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(t!1‘1),

we get 2 subgoals:

split_linear_read_side_effects_ok.1.1.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-15} pm′`states(s′)

{1} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Using lemma pm_linear_resolve_read_ok,

Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Read)(s!1)), length(t!1‘2)), union(pm_phy‘ro_addr, pm_phy‘rw_addr)),

we get 3 subgoals:

2162

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.1.1.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)

{1} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Using lemma linear_resolve_states,

Using lemma pm_states,

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma plain_memory_transformers_ok_read_side_effects_block,

Using lemma super_transformers_ok_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of memory_read_side_effect_super_transformers,

Instantiating quantified variables,

Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.1.

2163 C Proof scripts

split_linear_read_side_effects_ok.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Hiding formulas: 2,

Using lemma same_page_address_block_read,

we get 3 subgoals:

2164

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ union(pm′`ro_addr, pm′`rw_addr)(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

⊃ (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.2.1.
split_linear_read_side_effects_ok.1.1.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_ad

C.123 Proofs for Memory_Change_2 (memory.pvs)

address_block_subset_2 address_block has_next_state memory_read_transformers_memory_read subset_equal

Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_read_list_nse_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_read_list_nse, Expanding the definition of memory_read_list_nse, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: -6, Using lemma expr_transformer_invariant_next_ok[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_invariant_unchanged_read_list_nse.2.1:

{-1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-2} states′(s′)
{-3} states′(state(memory_read(pm′)(addr′′)(s′)))

{-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-5} OK?(memory_read(pm′)(addr′′)(s′))

{-6} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} j′ ≥ 0

{-9} data(memory_read(pm′)

(addr′)

(state(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))))

= data(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′))))

{-10} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-11} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{-12} addresses′(addr′)

{1} data(memory_read(pm′)

(addr′)

(state(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))))

= data(memory_read(pm′)(addr′)(s′))

Replacing using formula -9, Hiding formulas: -9, Using lemma expr_unchanged_memory_invariant_unchanged[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

2461 C Proof scripts

                                                                                                                   unchanged_memory_invariant_unchanged_read_list_nse.2.1.1:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-2} states′(s′)
{-3} addresses′(addr′)
{-4} OK?(memory_read(pm′)(addr′′)(s′))

{-5} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-6} states′(state(memory_read(pm′)(addr′′)(s′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-8} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-9} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-10} j′ ≥ 0
{-11} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{1} OK?(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′))))

{2} data(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′)))) = data(memory_read(pm′)(addr′)(s′))

Keeping (-3 -6 -9 1) and hiding *,

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                   This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.2.1.1.
                                                                                                                   unchanged_memory_invariant_unchanged_read_list_nse.2.1.2:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-2} states′(s′)
{-3} addresses′(addr′)
{-4} OK?(memory_read(pm′)(addr′′)(s′))

{-5} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-6} states′(state(memory_read(pm′)(addr′′)(s′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-8} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-9} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-10} j′ ≥ 0
{-11} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{1} OK?(memory_read(pm′)(addr′)(s′))

{2} data(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′)))) = data(memory_read(pm′)(addr′)(s′))

Keeping (-3 -9 1) and hiding *,

2462

C.123 Proofs for Memory_Change_2 (memory.pvs)

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.2.1.2.

                                                                                                                        unchanged_memory_invariant_unchanged_read_list_nse.2.2:

{-1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-2} states′(s′)
{-3} states′(state(memory_read(pm′)(addr′′)(s′)))

{-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-5} OK?(memory_read(pm′)(addr′′)(s′))

{-6} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} j′ ≥ 0

{-9} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-10} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{-11} addresses′(addr′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′ + 1, j′)),

addresses′)

{2} data(memory_read(pm′)

(addr′)

(state(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))))

= data(memory_read(pm′)(addr′)(s′))

Keeping (-9 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.2.2.

2463 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_read_list_nse.3:

{1} ∀ (size: nat, s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ OK?[State, Byte](memory_read(pm′)(addr′)(s))

{2} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size′)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size′) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, size′)(s))))

= data(memory_read(pm′)(addr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_read_list_nse_TCC3,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.3.

2464

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_read_list_nse.4:

{1} ∀ (size: nat, s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ OK?[State, Byte]

(memory_read(pm′) (addr′) (state[State, list[Byte]]

(memory_read_list_nse[State](pm′)(addr_2, size)(s))))

{2} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size′)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size′) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, size′)(s))))

= data(memory_read(pm′)(addr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_read_list_nse_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.4.

2465 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_read_list_nse.5:

{1} ∀ (size: nat, s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr_2, size)(s)) ∨ Exception?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr_2, size)(s))

{2} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size′)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size′) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, size′)(s))))

= data(memory_read(pm′)(addr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_read_list_nse_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.5.

Q.E.D.

C.123.28 Memory_Change_2.memory_write_list_ok_nse

                                                                                                                        Terse proof for memory_write_list_ok_nse.
                                                                                                                        memory_write_list_ok_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Address, s: State,

bl: list[Byte]): transformer_invariant?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ states(s) ⊃ OK?(memory_write_list_nse(pm)(waddr, bl)(s))

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ ),

Inducting on bl on formula 1,

2466

C.123 Proofs for Memory_Change_2 (memory.pvs)

we get 2 subgoals:

                                                                                                                        memory_write_list_ok_nse.1:

{1} ∀ (waddr: Address, s: State):

transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(null)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(null)))) ∧ states′(s) ⊃ OK?(memory_write_list_nse(pm′)(waddr, null)(s))

Expanding the definition of memory_write_list_nse,

Expanding the definition of ok_result,

which is trivially true.

                                                                                                                        This completes the proof of memory_write_list_ok_nse.1.

2467 C Proof scripts

                                                                                                                        memory_write_list_ok_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]): (∀ (waddr: Address, s: State):

transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var)))) ∧ states′(s) ⊃ OK?(memory_write_list_nse(pm′)(waddr, cons2_var)(s)))

⊃

(∀ (waddr: Address, s: State):

transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧ states′(s)

⊃ OK?(memory_write_list_nse(pm′)(waddr, cons(cons1_var, cons2_var))(s)))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: memory_write_transformers_memory_write address_block length comp_expr_forget_expr has_next_state address_block_subset_1 memory_write_transformers_mono

Expanding the definition of memory_write_list_nse,

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Simplifying, rewriting, and recording with decision procedures,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

2468

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        memory_write_list_ok_nse.2.1:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-3} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)
{1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

Using lemma expr_transformer_invariant_next_ok[State, Unit],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of memory_write_list_ok_nse.2.1.
                                                                                                                        memory_write_list_ok_nse.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-3} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

Keeping (-3 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of memory_write_list_ok_nse.2.2.

2469 C Proof scripts

                                                                                                                        memory_write_list_ok_nse.2.3:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-3} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′) (state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

Keeping (-2 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of memory_write_list_ok_nse.2.3.

Q.E.D.

C.123.29 Memory_Change_2.memory_write_list_ok

                                                                                                                        Terse proof for memory_write_list_ok.
                                                                                                                        memory_write_list_ok:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Address, s: State,

bl: list[Byte]): transformer_invariant?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?(memory_write_list(pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening,

Hiding formulas: -1,

Installing automatic rewrites from: union member has_next_state union_subset1 memory_write_side_effect_super_transformers_memory_write_side_effect subset_equal

Expanding the definition of memory_write_list,

Using lemma expr_transformers_ok_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of ##,

Using lemma side_effect_content_unchanged_content[State],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2470

C.123 Proofs for Memory_Change_2 (memory.pvs)

Using lemma memory_write_list_ok_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        memory_write_list_ok.1:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{2} OK?(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))

Keeping (-6 1) and hiding *,

Using lemma expr_transformer_invariant_next_ok[State, list[Byte]],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok.1.

                                                                                                                        memory_write_list_ok.2:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′, length (data

(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{2} OK?(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))

Replacing using formula -4, Keeping (-5 1) and hiding *, Using lemma transformers_ok_mono_transformers,

2471 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok.2.

                                                                                                                        memory_write_list_ok.3:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′, length (data

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))

{2} OK?(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Replacing using formula -4,

Keeping (-6 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok.3.

Q.E.D.

C.123.30 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse_TCC1

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_nse_TCC1.

2472

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ OK?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening,

Using lemma memory_write_list_ok_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Forward chaining on unchanged_memory_invariant_invariant,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse_TCC1.

Q.E.D.

C.123.31 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse_TCC2

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_nse_TCC2.

2473 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ OK?[State, Byte] (memory_read(pm) (raddr) (state[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: singleton

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_write_list_ok_nse,

Simplifying, rewriting, and recording with decision procedures,

Using lemma transformer_invariant_write_list_nse,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of result_pred,

Installing automatic rewrites from: has_next_state_expr_2_super has_next_state state_expr_2_super

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse_TCC2.

Q.E.D.

C.123.32 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse_TCC3

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_nse_TCC3.

2474

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse_TCC3:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ OK?[State, Byte](memory_read(pm)(raddr)(s))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: singleton

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse_TCC3.

Q.E.D.

C.123.33 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_nse.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ data(memory_read(pm)(raddr)(state(memory_write_list_nse(pm)(waddr, bl)(s)))) = data(memory_read(pm)(raddr)(s))

2475 C Proof scripts

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ raddr′ ),

Inducting on bl on formula 1,

we get 5 subgoals:

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse.1:

{1} ∀ (s: State, waddr: Address): unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, ad- dress_block(waddr, length(null))), singleton(raddr′)) ∧ transformers_ok?(states′, memory_write_transformers(pm′, ad- dress_block(waddr, length(null)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s) ⊃ data(memory_read(pm′) (raddr′)(state(memory_write_list_nse(pm′)(waddr, null)(s)))) = data(memory_read(pm′)(raddr′)(s))

Expanding the definition of memory_write_list_nse,

Expanding the definition of ok_result,

which is trivially true.

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.1.

2476

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]): (∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′, address_block (waddr, length(cons2_var))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var)(s))))

= data(memory_read(pm′)(raddr′)(s))) ⊃ (∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′, address_block (waddr, length (cons

(cons1_var, cons2_var)))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧

transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr, cons(cons1_var, cons2_var)) (s))))

= data(memory_read(pm′)(raddr′)(s)))

Repeatedly Skolemizing and flattening,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_write_list_ok_nse,

2477 C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

Installing automatic rewrites from: memory_write_transformers_memory_write singleton address_block_subset_1 memory_write_transformers_mono length ## address_block has_next_state subset_equal

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma expr_transformer_invariant_next_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of memory_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using -7, matching in *,

we get 3 subgoals:

2478

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse.2.1:

{-1} OK?(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))
{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))
{-4} OK?(memory_read(pm′)(raddr′)(s′))
{-5} OK?(memory_write_list_nse(pm′)(waddr′, cons(cons1_var′, cons2_var′))(s′))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr,

length(cons2_var′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length(cons2_var′))))

∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var′)(s))))

= data(memory_read(pm′)(raddr′)(s))

{-8} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

singleton(raddr′))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-11} states′(s′)

{1} data(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -7,

Using lemma expr_unchanged_memory_invariant_unchanged,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.2.1.

2479 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse.2.2:

{-1} OK?(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))
{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))
{-4} OK?(memory_read(pm′)(raddr′)(s′))
{-5} OK?(memory_write_list_nse(pm′)(waddr′, cons(cons1_var′, cons2_var′))(s′))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr,

length(cons2_var′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length(cons2_var′))))

∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var′)(s))))

= data(memory_read(pm′)(raddr′)(s))

{-8} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

singleton(raddr′))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-11} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

singleton(raddr′))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-8 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

2480

C.123 Proofs for Memory_Change_2 (memory.pvs)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.2.2.
unchanged_memory_invariant_unchanged_write_list_nse.2.3:

{-1} OK?(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))
{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))
{-4} OK?(memory_read(pm′)(raddr′)(s′))
{-5} OK?(memory_write_list_nse(pm′)(waddr′, cons(cons1_var′, cons2_var′))(s′))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr,

length(cons2_var′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length(cons2_var′))))

∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var′)(s))))

= data(memory_read(pm′)(raddr′)(s))

{-8} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

singleton(raddr′))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-11} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-9 1) and hiding *, Using lemma transformers_ok_mono_transformers,

2481 C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                   This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.2.3.
                                                                                                                   unchanged_memory_invariant_unchanged_write_list_nse.3:

{1} ∀ (bl: list[Byte], s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ OK?[State, Byte](memory_read(pm′)(raddr′)(s))

{2} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= data(memory_read(pm′)(raddr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse_TCC3,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                   This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.3.

2482

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse.4:

{1} ∀ (bl: list[Byte], s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

OK?[State, Byte]

(memory_read(pm′) (raddr′) (state[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))))

{2} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= data(memory_read(pm′)(raddr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.4.

2483 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_nse.5:

{1} ∀ (bl: list[Byte], s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

OK?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))

{2} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= data(memory_read(pm′)(raddr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.5.

Q.E.D.

C.123.34 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_TCC1

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_TCC1.

2484

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))),

singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_write_list_ok,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC1.

Q.E.D.

C.123.35 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_TCC2

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_TCC2.

2485 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Byte]

(memory_read(pm) (raddr) (state[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_write_list_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma expr_transformers_ok_ok,

Installing automatic rewrites from: singleton union_right has_next_state add_as_union memory_write_side_effect_super_transformers_memory_write_side_effect union_subset1 subset_equal subset_singleton union_right

Simplifying, rewriting, and recording with decision procedures,

Using lemma transformer_invariant_write_list,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2486

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC2.1:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} result_pred(states′)(expr_2_super(memory_write_list(pm′)(waddr′, bl′))(s′))
{-4} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))

{-5} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{1} states′(state(memory_write_list[State](pm′)(waddr′, bl′)(s′)))

{2} OK?[State, Byte]

(memory_read(pm′) (raddr′) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Rewriting using expr_result_pred_next_state, matching in *,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC2.1.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC2.2:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))

{-4} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-5} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-6} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))

{1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false)))))

{2} states′(state(memory_write_list[State](pm′)(waddr′, bl′)(s′)))

{3} OK?[State, Byte]

(memory_read(pm′) (raddr′) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Keeping (-4 1) and hiding *,

Rewriting using transformer_invariant_union_transformers, matching in *,

we get 2 subgoals:

2487 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC2.2.1:

{-1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false)))))

Hiding formulas: 2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC2.2.1.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC2.2.2:

{-1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformer_invariant?(states′,

singleton(expr_2_super(memory_write_side_effect(pm′)

(waddr′, bl′, false))))

{2} transformer_invariant?(states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false)))))

Hiding formulas: 2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC2.2.2.

Q.E.D.

C.123.36 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list_TCC3

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list_TCC3.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list_TCC3:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Byte](memory_read(pm)(raddr)(s))

Repeatedly Skolemizing and flattening,

2488

C.123 Proofs for Memory_Change_2 (memory.pvs)

Installing automatic rewrites from: singleton

Using lemma expr_transformers_ok_ok[State, Byte],

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC3.

Q.E.D.

C.123.37 Mem-

ory_Change_2.unchanged_memory_invariant_unchanged_write_list

                                                                                                                        Terse proof for unchanged_memory_invariant_unchanged_write_list.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ data(memory_read(pm)(raddr)(state(memory_write_list(pm)(waddr, bl)(s)))) = data(memory_read(pm)(raddr)(s))

Repeatedly Skolemizing and flattening,

Hiding formulas: -1,

Expanding the definition of memory_write_list,

Using lemma expr_transformers_ok_ok,

Installing automatic rewrites from: union_right memory_write_side_effect_super_transformers_memory_write_side_effect subset_equal singleton has_next_state union_subset1

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of ##,

Using lemma side_effect_content_unchanged_content[State],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Replacing using formula -4,

Hiding formulas: -4,

Using lemma expr_unchanged_memory_invariant_next_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

2489 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list.1:

{-1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-2} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-3} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

=

data(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{-4} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-5} states′(s′)

{-6} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-7} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-8} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -2,

Using lemma expr_unchanged_memory_invariant_unchanged,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2490

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_unchanged_write_list.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))

{-5} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

=

data(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{-6} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} OK?(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -1, -5, 2,

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list.1.1.

2491 C Proof scripts

                                                                                                                        unchanged_memory_invariant_unchanged_write_list.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))

{-5} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

=

data(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{-6} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} OK?(memory_read(pm′)(raddr′)(s′))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -1, -5, 2,

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list.1.2.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list.2:

{-1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-2} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-4} states′(s′)

{-5} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-7 1) and hiding *,

2492

C.123 Proofs for Memory_Change_2 (memory.pvs)

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list.2.
                                                                                                                        unchanged_memory_invariant_unchanged_write_list.3:

{-1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-2} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-4} states′(s′)

{-5} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

singleton(raddr′))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-3 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_unchanged_write_list.3.

Q.E.D.

C.123.38 Memory_Change_2.unchanged_memory_invariant_read_list

                                                                                                                        Terse proof for unchanged_memory_invariant_read_list.
                                                                                                                        unchanged_memory_invariant_read_list:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], addr: Ad-

dress,

size: nat): unchanged_memory_invariant?(pm, states,

(memory_read_transformers (pm, address_block(addr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(addr, size))), addresses)

∧

transformers_ok?(states,

(memory_read_transformers (pm, addresses) ∪ memory_read_side_effect_super_transformers (pm, addresses)))

∧ (address_block(addr, size) ⊆ addresses)

⊃

unchanged_memory_invariant?(pm, states, singleton(expr_2_super(memory_read_list(pm)(addr, size))), addresses)

2493 C Proof scripts

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: result_pred state_expr_2_super ok_expr_2_super has_next_state memory_read_transformers_mono subset_bigger_union_left memory_read_side_effect_super_transformers_mono subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right union_left union_right transformers_ok_union_transformers memory_read_transformers_memory_read memory_read_side_effect_super_transformers_memory_read_side_effect

Using lemma transformers_ok_mono_transformers,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of unchanged_memory_invariant?,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        unchanged_memory_invariant_read_list.1:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-2} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-3} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-4} size′ ≥ 0

{-5} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-6} (address_block(addr′, size′) ⊆ addresses′)

{1} transformer_invariant?(states′, singleton(expr_2_super(memory_read_list(pm′)(addr′, size′))))

Expanding the definition of transformer_invariant?,

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -2,

Hiding formulas: -2,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_read_list_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma memory_read_list_next_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_read_list.1.

2494

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_read_list.2:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-2} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-3} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-4} size′ ≥ 0

{-5} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-6} (address_block(addr′, size′) ⊆ addresses′)

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(memory_read_list(pm′)(addr′, size′)))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -4,

Hiding formulas: -4,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of memory_read_list,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma memory_read_list_nse_next_length,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2495 C Proof scripts

                                                                                                                        unchanged_memory_invariant_read_list.2.1:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-2} states′(s′)
{-3} states′(state(memory_read_list_nse(pm′)(addr′, size′)(s′)))
{-4} length(data(memory_read_list_nse(pm′)(addr′, size′)(s′))) = size′

{-5} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-7} addresses′(a′)
{-8} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))

{-9} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false)

(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-10} OK?(memory_read(pm′)(a′)(s′))

{-11} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-12} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-13} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-14} size′ ≥ 0
{-15} (address_block(addr′, size′) ⊆ addresses′)

{1} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Using lemma expr_unchanged_memory_invariant_unchanged[State, list[Byte]],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2496

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_read_list.2.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-2} states′(state(memory_read_list_nse(pm′)(addr′, size′)(s′)))
{-3} addresses′(a′)

{-4} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false)

(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-5} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-6} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

=

data(memory_read(pm′)

(a′)(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-7} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-8} states′(s′)
{-9} length(data(memory_read_list_nse(pm′)(addr′, size′)(s′))) = size′

{-10} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-11} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))
{-12} OK?(memory_read(pm′)(a′)(s′))

{-13} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-14} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-15} size′ ≥ 0
{-16} (address_block(addr′, size′) ⊆ addresses′)

{1} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Replacing using formula -6,

Hiding formulas: -6,

Using lemma unchanged_memory_invariant_unchanged_read_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2497 C Proof scripts

Keeping (-13 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_read_list.2.1.1.
                                                                                                                        unchanged_memory_invariant_read_list.2.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-2} states′(state(memory_read_list_nse(pm′)(addr′, size′)(s′)))
{-3} addresses′(a′)

{-4} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-5} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-6} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-7} states′(s′)
{-8} length(data(memory_read_list_nse(pm′)(addr′, size′)(s′))) = size′

{-9} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-10} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))
{-11} OK?(memory_read(pm′)(a′)(s′))

{-12} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-13} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-14} size′ ≥ 0
{-15} (address_block(addr′, size′) ⊆ addresses′)
{1} OK?(memory_read(pm′)(a′)(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{2} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Keeping (-2 -3 -10 -12 1) and hiding *,

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_invariant_read_list.2.1.2.

2498

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_invariant_read_list.2.2:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-2} states′(s′)

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-5} addresses′(a′)
{-6} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))

{-7} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false)

(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-8} OK?(memory_read(pm′)(a′)(s′))

{-9} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-11} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-12} size′ ≥ 0
{-13} (address_block(addr′, size′) ⊆ addresses′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′))) {2} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Keeping (-4 1) and hiding *,

Forward chaining on unchanged_memory_invariant_invariant,

                                                                                                                        This completes the proof of unchanged_memory_invariant_read_list.2.2.

Q.E.D.

C.123.39 Mem-

ory_Change_2.unchanged_memory_read_list_write_list_nse_TCC1

                                                                                                                        Terse proof for unchanged_memory_read_list_write_list_nse_TCC1.

2499 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

memory_read_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl))))

∧ states(s) ⊃ OK?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening,

Using lemma memory_write_list_ok_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using unchanged_memory_write_invariant_transformer_invariant, matching in *,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse_TCC1.

Q.E.D.

C.123.40 Mem-

ory_Change_2.unchanged_memory_read_list_write_list_nse_TCC2

                                                                                                                        Terse proof for unchanged_memory_read_list_write_list_nse_TCC2.

2500

C.123 Proofs for Memory_Change_2 (memory.pvs)

unchanged_memory_read_list_write_list_nse_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

memory_read_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl))))

∧ states(s) ⊃ OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm)(waddr, length[Byte](bl)) (state[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_nse_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_read_list_write_list_nse_TCC2.1:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(waddr′, length(bl′))))

{-2} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

address_block(waddr′, length(bl′)))

{-3} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-4} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{-6} states′(s′)
{1} states′(state[State, Unit](memory_write_list_nse[State](pm′)(waddr′, bl′)(s′)))

{2} OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit]

(memory_write_list_nse[State](pm′)(waddr′, bl′)(s′))))

Hiding formulas: 2,

2501 C Proof scripts

Using lemma unchanged_memory_write_invariant_transformer_invariant,

Simplifying, rewriting, and recording with decision procedures,

Using lemma transformer_invariant_write_list_nse,

Simplifying, rewriting, and recording with decision procedures,

Using lemma memory_write_list_ok_nse,

Simplifying, rewriting, and recording with decision procedures,

Installing automatic rewrites from: has_next_state

Rewriting using expr_result_pred_next_state, matching in *,

                                                                                                                   This completes the proof of unchanged_memory_read_list_write_list_nse_TCC2.1.
                                                                                                                   unchanged_memory_read_list_write_list_nse_TCC2.2:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(waddr′, length(bl′))))

{-2} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

address_block(waddr′, length(bl′)))

{-3} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-4} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{-6} states′(s′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

length[Byte](bl′))))

{2} OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit]

(memory_write_list_nse[State](pm′)(waddr′, bl′)(s′))))

Forward chaining on unchanged_memory_invariant_invariant,

                                                                                                                   This completes the proof of unchanged_memory_read_list_write_list_nse_TCC2.2.

Q.E.D.

C.123.41

Memory_Change_2.unchanged_memory_read_list_write_list_nse

                                                                                                                 Terse proof for unchanged_memory_read_list_write_list_nse.

2502

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

memory_read_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl))))

∧ states(s) ⊃ data(memory_read_list_nse(pm)(waddr, length(bl))

(state(memory_write_list_nse(pm)(waddr, bl)(s))))

= bl

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ ),

Inducting on bl on formula 1,

we get 4 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list_nse.1:

{1} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(null))),

address_block(waddr, length(null)))

∧

unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(null))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(null))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(null)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(null))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(null))

(state(memory_write_list_nse(pm′)(waddr, null)(s))))

= null

2503 C Proof scripts

Repeatedly Skolemizing and flattening,

Keeping 1 and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.1.

2504

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]): (∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, address_block (waddr, length(cons2_var))),

address_block(waddr, length(cons2_var)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var))

(state(memory_write_list_nse(pm′) (waddr, cons2_var) (s))))

= cons2_var) ⊃ (∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, address_block (waddr, length (cons

(cons1_var, cons2_var)))),

address_block(waddr,

length(cons(cons1_var, cons2_var))))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr,

length(cons

(cons1_var, cons2_var))))

∧

changed_memory_invariant?(pm′, states′,

address_block(waddr,

length(cons(cons1_var, cons2_var))))

∧

transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons(cons1_var, cons2_var)))

(state(memory_write_list_nse(pm′)

(waddr,

cons(cons1_var, cons2_var)) (s))))

= cons(cons1_var, cons2_var))

2505 C Proof scripts

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_block address_block_subset_1 ##! length subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right memory_read_transformers_memory_read memory_read_transformers_mono memory_write_transformers_memory_write memory_write_transformers_mono transformer_invariant_mono_transformers expr_transformer_invariant_next_ok ok_result has_next_state state_expr_2_super ok_expr_2_super

Using lemma unchanged_memory_write_invariant_transformer_invariant,

Simplifying, rewriting, and recording with decision procedures,

Using lemma memory_write_list_ok_nse,

Simplifying, rewriting, and recording with decision procedures,

Using lemma unchanged_memory_read_list_write_list_nse_TCC2,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of memory_write_list_nse,

Expanding the definition of memory_read_list_nse,

Expanding the definition of memory_write_list_nse,

Expanding the definition of memory_write_list_nse,

Expanding the definition of memory_read_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Applying extensionality,

we get 2 subgoals:

2506

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.1:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?[State, list[Byte]]

(OK(state(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write (pm′) (waddr′,

cons1_var′)

(s′)))))))),

cons(data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′)))))),

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse (pm′) (waddr′ + 1, cons2_var′) (state

(memory_write(pm′) (waddr′, cons1_var′) (s′)))))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

2507 C Proof scripts

Hiding formulas: -2, -3, -4, -7,

Using lemma expr_transformer_invariant_next_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.1.1:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} data(memory_read(pm′)

(waddr′)

(state(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

=

data(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-4} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

2508

C.123 Proofs for Memory_Change_2 (memory.pvs)

Replacing using formula -2,

Keeping (-9 1) and hiding *,

Expanding the definition of changed_memory_invariant?,

Applying disjunctive simplification to flatten sequent,

Rewriting using -2, matching in *,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.1.
                                                                                                                        unchanged_memory_read_list_write_list_nse.2.1.2:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-7} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} states′(s′)
{1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(waddr′))))

{2} data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

Keeping (-9 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.2.

2509 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.1.3:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-7} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

Keeping (-10 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.3.

2510

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.1.4:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-7} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

singleton(waddr′))

{2} data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

Hiding formulas: 2,

Using lemma unchanged_memory_write_invariant_unchanged_memory_invariant,

Simplifying, rewriting, and recording with decision procedures,

Keeping 1 and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.4.

2511 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?[State, list[Byte]]

(OK(state(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write (pm′) (waddr′,

cons1_var′)

(s′)))))))),

cons(data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′)))))),

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse (pm′) (waddr′ + 1, cons2_var′) (state

(memory_write(pm′) (waddr′, cons1_var′) (s′)))))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2512

C.123 Proofs for Memory_Change_2 (memory.pvs)

Hiding formulas: -4,

Using lemma unchanged_memory_read_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

2513 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.1:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2514

C.123 Proofs for Memory_Change_2 (memory.pvs)

Replacing using formula -1,

Rewriting using -7, matching in *,

we get 6 subgoals:

2515 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.1.1:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

address_block(waddr′ + 1, length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2516

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-8 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.1.

2517 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.1.2:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′ + 1, length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2518

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-9 1) and hiding *,

Using lemma unchanged_memory_write_invariant_mono_addresses,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.2.

2519 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.1.3:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} changed_memory_invariant?(pm′, states′,

address_block(waddr′ + 1, length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2520

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-10 1) and hiding *,

Using lemma changed_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.3.

2521 C Proof scripts

                                                                                                                   unchanged_memory_read_list_write_list_nse.2.2.1.4:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2522

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-11 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.4.

2523 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.1.5:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2524

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-12 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.5.

2525 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.1.6:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)
{1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2526

C.123 Proofs for Memory_Change_2 (memory.pvs)

Using lemma expr_transformer_invariant_next_ok,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.6.

2527 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′)))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2528

C.123 Proofs for Memory_Change_2 (memory.pvs)

Hiding formulas: -2, -3, -6, 2,

Using lemma transformer_invariant_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.2.1:

{-1} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′))

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-4} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-5} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-6} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-7} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′)))))

Rewriting using expr_result_pred_next_state, matching in *,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.2.1.

2529 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-5} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-6} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-8} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-9} states′(s′)
{1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{2} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′)))))

Keeping (-3 1) and hiding *,

Using lemma expr_transformer_invariant_next_ok[State, Unit],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.2.2.

2530

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.2.3:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-5} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-6} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-8} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-9} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′)(s′)))))

Keeping (-3 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.2.3.

2531 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.3:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2532

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-10 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.3.

2533 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.4:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′ + 1, length(cons2_var′))) ∪ singleton(expr_2_super (memory_read(pm′)(waddr′)))), address_block(waddr′, 1 + length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2534

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-7 1) and hiding *,

Rewriting using unchanged_memory_invariant_union_transformers, matching in *,

we get 2 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.4.1:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{2} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′ + 1, length(cons2_var′))) ∪ singleton(expr_2_super (memory_read(pm′)(waddr′)))), address_block(waddr′, 1 + length(cons2_var′)))

Hiding formulas: 2,

Using lemma unchanged_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.4.1.
                                                                                                                        unchanged_memory_read_list_write_list_nse.2.2.4.2:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(waddr′))), address_block(waddr′, 1 + length(cons2_var′)))

{2} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′ + 1, length(cons2_var′))) ∪ singleton(expr_2_super (memory_read(pm′)(waddr′)))), address_block(waddr′, 1 + length(cons2_var′)))

Hiding formulas: 2,

Using lemma unchanged_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.4.2.

2535 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_nse.3:

{1} ∀ (bl: list[Byte], waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ states′(s)

⊃

OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm′)(waddr, length[Byte](bl)) (state[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))))

{2} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

address_block(waddr, length(bl′)))

∧

unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(bl′))

(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= bl′

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_read_list_write_list_nse_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.3.

2536

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_nse.4:

{1} ∀ (bl: list[Byte], waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ states′(s)

⊃

OK?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s)) ∨

Exception?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))

{2} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

address_block(waddr, length(bl′)))

∧

unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl′))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(bl′))

(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= bl′

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_read_list_write_list_nse_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_nse.4.

Q.E.D.

2537 C Proof scripts

C.123.42

Memory_Change_2.unchanged_memory_read_list_write_list_TCC1

                                                                                                                        Terse proof for unchanged_memory_read_list_write_list_TCC1.
                                                                                                                        unchanged_memory_read_list_write_list_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states, (memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ (memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl))))), address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

(memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_read_side_effect(pm))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening, Using lemma memory_write_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right transformer_invariant_union_transformers unchanged_memory_write_invariant_transformer_invariant

Rewriting using transformer_invariant_union_transformers, matching in *,

Hiding formulas: -1, 2,

Forward chaining on unchanged_memory_invariant_invariant,

Hiding formulas: -2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_TCC1.

Q.E.D.

C.123.43

Memory_Change_2.unchanged_memory_read_list_write_list_TCC2

                                                                                                                        Terse proof for unchanged_memory_read_list_write_list_TCC2.

2538

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states, (memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ (memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl))))), address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

(memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_read_side_effect(pm))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, list[Byte]]

(memory_read_list[State] (pm)(waddr, length[Byte](bl)) (state[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right transformer_invariant_union_transformers has_next_state memory_write_side_effect_super_transformers_memory_write_side_effect

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_read_list_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2539 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_TCC2.1:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-4} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-5} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-8} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-9} states′(s′)
{1} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

{2} OK?[State, list[Byte]]

(memory_read_list[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Hiding formulas: 2,

Using lemma unchanged_memory_write_invariant_transformer_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_write_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list_TCC2.1.1:

{-1} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-3} states′(s′)
{-4} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))
{-5} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-11} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

2540

C.123 Proofs for Memory_Change_2 (memory.pvs)

Using lemma transformer_invariant_write_list,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_read_list_write_list_TCC2.1.1.1:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} result_pred(states′)(expr_2_super(memory_write_list(pm′)(waddr′, bl′))(s′))

{-4} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-5} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))
{-6} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-7} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-10} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-11} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Rewriting using expr_result_pred_next_state, matching in *,

This completes the proof of unchanged_memory_read_list_write_list_TCC2.1.1.1.

2541 C Proof scripts

                                                                                                                   unchanged_memory_read_list_write_list_TCC2.1.1.2:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)

{-3} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-4} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))
{-5} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-11} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ {expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false))}))

{2} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Rewriting using add_as_union, matching in *,

Rewriting using transformer_invariant_union_transformers, matching in *,

Keeping (-8 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                   This completes the proof of unchanged_memory_read_list_write_list_TCC2.1.1.2.

2542

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list_TCC2.1.2:

{-1} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-3} states′(s′)
{-4} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-6} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-8} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-9} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-10} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{2} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Keeping (-5 -7 1) and hiding *,

Rewriting using transformer_invariant_union_transformers, matching in *,

Hiding formulas: -1, 2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_TCC2.1.2.

2543 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list_TCC2.2:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-4} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-5} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-8} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-9} states′(s′)

{1} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length [Byte](bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length [Byte](bl′)))))

{2} OK?[State, list[Byte]]

(memory_read_list[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Keeping (-2 1) and hiding *,

Rewriting using transformer_invariant_union_transformers, matching in *,

we get 2 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list_TCC2.2.1:

{-1} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{1} transformer_invariant?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

length[Byte](bl′))))

{2} transformer_invariant?(states′, (memory_read_transformers (pm′, address_block(waddr′, length [Byte](bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length [Byte](bl′)))))

Hiding formulas: 2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_TCC2.2.1.
                                                                                                                        unchanged_memory_read_list_write_list_TCC2.2.2:

{-1} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{1} transformer_invariant?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block

(waddr′,

length[Byte](bl′))))

{2} transformer_invariant?(states′, (memory_read_transformers (pm′, address_block(waddr′, length [Byte](bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length [Byte](bl′)))))

2544

C.123 Proofs for Memory_Change_2 (memory.pvs)

Hiding formulas: 2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list_TCC2.2.2.

Q.E.D.

C.123.44 Memory_Change_2.unchanged_memory_read_list_write_list

                                                                                                                        Terse proof for unchanged_memory_read_list_write_list.
                                                                                                                        unchanged_memory_read_list_write_list:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states, (memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ (memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl))))), address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

(memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_read_side_effect(pm))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ data(memory_read_list(pm)(waddr, length(bl))

(state(memory_write_list(pm)(waddr, bl)(s))))

= bl Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_read_list_write_list_TCC2, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: address_block address_block_subset_1 ##! length subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right memory_read_transformers_memory_read memory_read_transformers_mono memory_write_transformers_memory_write memory_write_transformers_mono transformer_invariant_mono_transformers expr_transformer_invariant_next_ok ok_result has_next_state state_expr_2_super ok_expr_2_super memory_write_side_effect_super_transformers_memory_write_side_effect memory_read_side_effect_super_transformers_memory_read_side_effect

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures, Forward chaining on unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Simplifying, rewriting, and recording with decision procedures,

2545 C Proof scripts

Expanding the definition of memory_read_list,

Expanding the definition of memory_write_list,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma side_effect_content_unchanged_content,

Simplifying, rewriting, and recording with decision procedures,

Replacing using formula -1,

Using lemma unchanged_memory_read_list_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

2546

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list.1:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} data(memory_read_list_nse(pm′)(waddr′, length(bl′))

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

= bl′
{-5} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-6} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-7} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-8} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-9} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-10} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-11} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-14} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-15} states′(s′)

{1} data(memory_read_side_effect(pm′) (waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2547 C Proof scripts

Replacing using formula -4,

Using lemma side_effect_content_unchanged_content,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -4, -5, -9, -13, -14, 2,

Using lemma memory_read_list_nse_next_length,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

                                                                                                                        unchanged_memory_read_list_write_list.1.1:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))))

{2} states′(state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))))

Hiding formulas: 2,

Using lemma transformer_invariant_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2548

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list.1.1.1:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-2} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′, bl′))

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))

{-3} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-4} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-9} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′)))))

Using lemma expr_result_pred_next_state[State, Unit],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: -1, -7, 2,

Using lemma memory_write_list_ok_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2549 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list.1.1.1.1:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-2} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{2} has_next_state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Keeping (-8 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.1.1.1.1.
                                                                                                                        unchanged_memory_read_list_write_list.1.1.1.2:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-2} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} has_next_state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Forward chaining on unchanged_memory_write_invariant_transformer_invariant,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.1.1.1.2.

2550

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list.1.1.2:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-2} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′)))))

Forward chaining on unchanged_memory_write_invariant_transformer_invariant,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.1.1.2.

2551 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list.1.2:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′, length[Byte](bl′))))

{2} states′(state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))))

Keeping (-8 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.1.2.

2552

C.123 Proofs for Memory_Change_2 (memory.pvs)

                                                                                                                        unchanged_memory_read_list_write_list.1.3:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

length[Byte](bl′))))

{2} states′(state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))))

Keeping (-4 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.1.3.

2553 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list.2:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-14} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{2} data(memory_read_side_effect(pm′) (waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2554

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-11 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.2.

2555 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list.3:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-14} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(waddr′, length(bl′))))

{2} data(memory_read_side_effect(pm′) (waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2556

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-10 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.3.

2557 C Proof scripts

                                                                                                                        unchanged_memory_read_list_write_list.4:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-14} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

address_block(waddr′, length(bl′)))

{2} data(memory_read_side_effect(pm′) (waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2558

C.124 Proofs for Memory_Change_3 (memory.pvs)

Keeping (-9 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

                                                                                                                        This completes the proof of unchanged_memory_read_list_write_list.4.

Q.E.D.

C.124 Proofs for Memory_Change_3 (memory.pvs)

C.124.1 Mem-

ory_Change_3.expr_unchanged_memory_invariant_unchanged_TCC1

                                                                                                                        Terse proof for expr_unchanged_memory_invariant_unchanged_TCC1.
                                                                                                                        expr_unchanged_memory_invariant_unchanged_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]], a: Address): OK?(memory_read(pm)(a)(s)) ∧ OK?(q(s)) ∧ addresses(a) ∧ transformers(expr_2_super(q)) ∧ states(s) ∧ unchanged_memory_invariant?(pm, states, transformers, addresses) ⊃ OK?[State, Data](q(s)) ∨ Exception?[State, Data](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_unchanged_TCC1.

Q.E.D.

C.124.2

Memory_Change_3.expr_unchanged_memory_invariant_unchanged

                                                                                                                        Terse proof for expr_unchanged_memory_invariant_unchanged.
                                                                                                                        expr_unchanged_memory_invariant_unchanged:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]], a: Address):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ addresses(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm)(a)(s)) ∧ OK?(memory_read(pm)(a)(state(q(s))))

⊃ data(memory_read(pm)(a)(state(q(s)))) = data(memory_read(pm)(a)(s))

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged,

Installing automatic rewrites from: state_expr_2_super ok_expr_2_super has_next_state Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_unchanged.

2559 C Proof scripts

Q.E.D.

C.124.3 Mem-

ory_Change_3.expr_unchanged_memory_invariant_next_ok_TCC1

                                                                                                                        Terse proof for expr_unchanged_memory_invariant_next_ok_TCC1.
                                                                                                                        expr_unchanged_memory_invariant_next_ok_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]]):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ has_next_state(q(s)) ⊃ OK?[State, Data](q(s)) ∨ Exception?[State, Data](q(s))

Repeatedly Skolemizing and flattening,

Expanding the definition of has_next_state,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_next_ok_TCC1.

Q.E.D.

C.124.4

Memory_Change_3.expr_unchanged_memory_invariant_next_ok

                                                                                                                        Terse proof for expr_unchanged_memory_invariant_next_ok.
                                                                                                                        expr_unchanged_memory_invariant_next_ok:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]]):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ has_next_state(q(s)) ⊃ states(state(q(s)))

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_next_ok[State],

Installing automatic rewrites from: has_next_state_expr_2_super state_expr_2_super Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_next_ok.

Q.E.D.

C.125 Proofs for Memory_Change_4 (memory.pvs)

C.125.1

Memory_Change_4.expr_unchanged_memory_invariant_composition

                                                                                                                        Terse proof for expr_unchanged_memory_invariant_composition.

2560

C.125 Proofs for Memory_Change_4 (memory.pvs)

expr_unchanged_memory_invariant_composition:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers_1, transformers_2: PRED[[State → SuperResult[State]]], q_{1}: [State → ExprResult[State, Data1]], q_{2}: [State → ExprRe-

sult[State, Data2]]):

transformers_1(expr_2_super(q_{1})) ∧ transformers_2(expr_2_super(q_{2})) ∧ transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ unchanged_memory_invariant?(pm, states, transformers_1, addresses) ∧ unchanged_memory_invariant?(pm, states, transformers_2, addresses)

⊃ unchanged_memory_invariant?(pm, states, singleton(expr_2_super(q_{1} ## q_{2})), addresses)

Expanding the definition of unchanged_memory_invariant?,

Repeatedly Skolemizing and flattening,

Case splitting on transformer_invariant?(states!1, singleton(expr_2_super(q1!1 ## q2!1))),

we get 2 subgoals:

2561 C Proof scripts

                                                                                                                   expr_unchanged_memory_invariant_composition.1:

{-1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)

{-6} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-7} transformer_invariant?(states′, transformers′′)

{-8} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2}))) ∧ (∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -10,

Instantiating the top quantifier in -6 with the terms: (s!1 expr_2_super(q1!1) a!1),

Installing automatic rewrites from: ok_expr_2_super state_expr_2_super has_next_state has_next_state_expr_2_super ##

Instantiating the top quantifier in -8 with the terms: (state(expr_2_super(q1!1)(s!1)) expr_2_super(q2!1) a!1),

we get 2 subgoals:

2562

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        expr_unchanged_memory_invariant_composition.1.1:

{-1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′) ∧

transformers′(expr_2_super(q′_{1})) ∧

addresses′(a′) ∧

OK?(expr_2_super(q′_{1})(s′)) ∧

OK?(memory_read(pm′)(a′)(s′)) ∧

OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) ⊃ data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) = data(memory_read(pm′)(a′)(s′))

{-7} transformer_invariant?(states′, transformers′′)
{-8} states′(state(expr_2_super(q′_{1})(s′))) ∧

transformers′′(expr_2_super(q′_{2})) ∧

addresses′(a′) ∧

OK?(expr_2_super(q′_{2})(state(expr_2_super(q′_{1})(s′)))) ∧ OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) ∧ OK?(memory_read(pm′)

(a′)(state(expr_2_super(q′_{2})(state(expr_2_super(q′_{1})(s′))))))

⊃

data(memory_read(pm′)

(a′)(state(expr_2_super(q′_{2})(state(expr_2_super(q′_{1})(s′))))))

= data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′))))

{-9} states′(s′)
{-10} q′ = expr_2_super(q′_{1} ## q′_{2})
{-11} addresses′(a′)
{-12} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-13} OK?(memory_read(pm′)(a′)(s′))
{-14} OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′))))
{1} data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′)))) =

data(memory_read(pm′)(a′)(s′))

Expanding the definition of ##,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2563 C Proof scripts

                                                                                                                        expr_unchanged_memory_invariant_composition.1.1.1:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} data(memory_read(pm′)(a′)(state(q′_{1}(s′)))) =

data(memory_read(pm′)(a′)(s′))

{-10} transformer_invariant?(states′, transformers′′)
{-11} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-12} OK?(q′_{1}(s′))
{-13} OK?(q′_{2}(state(q′_{1}(s′))))
{-14} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} states′(state(q′_{1}(s′)))
{2} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) =

data(memory_read(pm′)(a′)(s′))

Rewriting using expr_transformer_invariant_next_ok, matching in * where s gets s!1, q gets q1!1, states gets states!1, transformers gets transformers!1,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_composition.1.1.1.

2564

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        expr_unchanged_memory_invariant_composition.1.1.2:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} transformer_invariant?(states′, transformers′′)
{-10} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-11} OK?(q′_{1}(s′))
{-12} OK?(q′_{2}(state(q′_{1}(s′))))
{-13} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} OK?(memory_read(pm′)(a′)(state(q′_{1}(s′))))
{2} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) =

data(memory_read(pm′)(a′)(s′))

Rewriting using expr_transformers_ok_ok, matching in * where s gets state(q1!1(s!1)), q gets memory_read(pm!1)(a!1), states gets states!1, transformers gets memory_read_transformers(pm!1, addresses!1),

we get 2 subgoals:

2565 C Proof scripts

                                                                                                                        expr_unchanged_memory_invariant_composition.1.1.2.1:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} transformer_invariant?(states′, transformers′′)
{-10} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-11} OK?(q′_{1}(s′))
{-12} OK?(q′_{2}(state(q′_{1}(s′))))
{-13} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} states′(state(q′_{1}(s′)))
{2} OK?(memory_read(pm′)(a′)(state(q′_{1}(s′))))
{3} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) =

data(memory_read(pm′)(a′)(s′))

Rewriting using expr_transformer_invariant_next_ok, matching in * where s gets s!1, q gets q1!1, states gets states!1, transformers gets transformers!1,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_composition.1.1.2.1.

2566

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        expr_unchanged_memory_invariant_composition.1.1.2.2:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} transformer_invariant?(states′, transformers′′)
{-10} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-11} OK?(q′_{1}(s′))
{-12} OK?(q′_{2}(state(q′_{1}(s′))))
{-13} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} memory_read_transformers(pm′, addresses′)(expr_2_super(memory_read(pm′)(a′)))
{2} OK?(memory_read(pm′)(a′)(state(q′_{1}(s′))))
{3} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) =

data(memory_read(pm′)(a′)(s′))

Rewriting using memory_read_transformers_memory_read, matching in *,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_composition.1.1.2.2.

2567 C Proof scripts

                                                                                                                        expr_unchanged_memory_invariant_composition.1.2:

{-1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′) ∧

transformers′(expr_2_super(q′_{1})) ∧

addresses′(a′) ∧

OK?(expr_2_super(q′_{1})(s′)) ∧

OK?(memory_read(pm′)(a′)(s′)) ∧

OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) ⊃ data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) = data(memory_read(pm′)(a′)(s′))

{-7} transformer_invariant?(states′, transformers′′)
{-8} states′(s′)
{-9} q′ = expr_2_super(q′_{1} ## q′_{2})
{-10} addresses′(a′)
{-11} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-12} OK?(memory_read(pm′)(a′)(s′))
{-13} OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′))))
{1} OK?(q′_{1}(s′)) ∨ abnormal?[State](expr_2_super[State, Data1](q′_{1})(s′))
{2} data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′)))) =

data(memory_read(pm′)(a′)(s′))

Keeping (-11 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_composition.1.2.

2568

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        expr_unchanged_memory_invariant_composition.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers′′(expr_2_super(q′_{2}))
{-3} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, transformers′)

{-5} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-6} transformer_invariant?(states′, transformers′′)

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2}))) ∧ (∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Rewriting using expr_composition_transformer_invariant, matching in *,

we get 2 subgoals:

2569 C Proof scripts

                                                                                                                        expr_unchanged_memory_invariant_composition.2.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers′′(expr_2_super(q′_{2}))
{-3} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, transformers′)

{-5} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-6} transformer_invariant?(states′, transformers′′)

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{3} false ∧

(∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Keeping (-1 -3 1) and hiding *,

Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1 gets singleton(expr_2_super(q1!1)), transformers_2 gets transformers!1,

Hiding formulas: (-2 2),

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_composition.2.1.

2570

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        expr_unchanged_memory_invariant_composition.2.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers′′(expr_2_super(q′_{2}))
{-3} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, transformers′)

{-5} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-6} transformer_invariant?(states′, transformers′′)

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{2})))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{3} false ∧

(∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Keeping (-2 -5 1) and hiding *,

Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1 gets singleton(expr_2_super(q2!1)), transformers_2 gets transformers!2,

Hiding formulas: (-2 2),

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of expr_unchanged_memory_invariant_composition.2.2.

Q.E.D.

C.125.2

Memory_Change_4.fexpr_unchanged_memory_invariant_composition

                                                                                                                        Terse proof for fexpr_unchanged_memory_invariant_composition.

2571 C Proof scripts

                                                                                                                        fexpr_unchanged_memory_invariant_composition:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers_1: PRED[[State → SuperResult[State]]], q_{1}: [State → ExprResult[State, Data1]], q_{2}: [Data1 → [State → ExprResult[State, Data2]]], P: PRED[Data1]):

(transformers_1(expr_2_super(q_{1})) ∧ transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ unchanged_memory_invariant?(pm, states, transformers_1, addresses) ∧ (∀ (s: (states)): OK?(q_{1}(s)) ⊃ P (data(q_{1}(s)))) ∧ (∀ (d: (P)):

unchanged_memory_invariant?(pm, states, singleton(expr_2_super(q_{2}(d))), addresses)))

⊃ unchanged_memory_invariant?(pm, states, singleton(expr_2_super(q_{1} ## q_{2})), addresses)

Expanding the definition of unchanged_memory_invariant?,

Repeatedly Skolemizing and flattening,

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        fexpr_unchanged_memory_invariant_composition.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Rewriting using fexpr_composition_transformer_invariant[State, Data1, Data2], matching in * where states gets states!1, P gets P!1,

we get 2 subgoals:

                                                                                                                        fexpr_unchanged_memory_invariant_composition.1.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Rewriting using transformer_invariant_mono_transformers[State], matching in * where transformers_1 gets singleton(expr_2_super(q1!1)), transformers_2 gets transformers!1,

we get 2 subgoals:

2572

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        fexpr_unchanged_memory_invariant_composition.1.1.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} (singleton(expr_2_super (q′_{1})) ⊆ transformers′)
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{3} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Keeping (-1 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.1.1.1.
                                                                                                                        fexpr_unchanged_memory_invariant_composition.1.1.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} transformer_invariant?(states′, transformers′)
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{3} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Expanding the definition of unchanged_memory_invariant?,

which is trivially true.

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.1.1.2.
                                                                                                                        fexpr_unchanged_memory_invariant_composition.1.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} ∀ (d: (P′)): transformer_invariant?(states′, singleton(expr_2_super(q′_{2}(d))))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of unchanged_memory_invariant?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.1.2.

2573 C Proof scripts

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -2,

Rewriting using state_expr_2_super, matching in *,

we get 2 subgoals:

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′)))) = data(memory_read(pm′)(a′)(s′))

Rewriting using comp_eval_if_ok_fexpr, matching in *,

we get 2 subgoals:

2574

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) = data(memory_read(pm′)(a′)(s′))

Instantiating the top quantifier in -11 with the terms: (data(q1!1(s!1))),

we get 2 subgoals:

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1.1:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-11} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) = data(memory_read(pm′)(a′)(s′))

Using lemma expr_unchanged_memory_invariant_composition,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

2575 C Proof scripts

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1.1.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-5} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′))))), addresses′)

{-6} states′(s′)
{-7} q′ = expr_2_super(q′_{1} ## q′_{2})
{-8} addresses′(a′)
{-9} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-10} OK?(memory_read(pm′)(a′)(s′))
{-11} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-12} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Using lemma expr_unchanged_memory_invariant_unchanged,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′))))), addresses′)

{-2} states′(s′)
{-3} addresses′(a′)
{-4} OK?(memory_read(pm′)(a′)(s′))
{-5} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-6} transformers′(expr_2_super(q′_{1}))
{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-9} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-10} q′ = expr_2_super(q′_{1} ## q′_{2})
{-11} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-12} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} OK?((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))
{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Keeping (-11 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.1.

2576

C.125 Proofs for Memory_Change_4 (memory.pvs)

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′))))), addresses′)

{-2} states′(s′)
{-3} addresses′(a′)
{-4} OK?(memory_read(pm′)(a′)(s′))
{-5} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-6} transformers′(expr_2_super(q′_{1}))
{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-9} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-10} q′ = expr_2_super(q′_{1} ## q′_{2})
{-11} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-12} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′)))))
(expr_2_super((q′_{1} ## q′_{2}(data(q′_{1}(s′))))))
{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Expanding the definition of singleton,

which is trivially true.

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.2.
                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1.1.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-5} states′(s′)
{-6} q′ = expr_2_super(q′_{1} ## q′_{2})
{-7} addresses′(a′)
{-8} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-9} OK?(memory_read(pm′)(a′)(s′))
{-10} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-11} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} singleton(expr_2_super(q′_{2}(data(q′_{1}(s′)))))
(expr_2_super(q′_{2}(data(q′_{1}(s′)))))
{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Expanding the definition of singleton,

which is trivially true.

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.1.2.

2577 C Proof scripts

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.1.2:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} P′(data[State, Data1](q′_{1}(s′)))
{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-4 3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.2.
                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.1.2:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} OK?(q′_{1}(s′))
{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′)))) =

data(memory_read(pm′)(a′)(s′))

Keeping (-4 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.2.

2578

C.126 Proofs for Memory_Physical_Memory (physical_memory.pvs)

                                                                                                                        fexpr_unchanged_memory_invariant_composition.2.2:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} has_next_state((q′_{1} ## q′_{2})(s′))
{2} data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′)))) =

data(memory_read(pm′)(a′)(s′))

Rewriting using ok_expr_2_super, matching in *,

Expanding the definition of has_next_state,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

                                                                                                                        This completes the proof of fexpr_unchanged_memory_invariant_composition.2.2.

Q.E.D.

C.126 Proofs for Memory_Physical_Memory

(physical_memory.pvs)

This theory contains no provable formal statements.

C.127 Proofs for Memory_access (result.pvs)

This theory contains no provable formal statements.

C.128 Proofs for Memory_access_adt

(Memory_access_adt.pvs)

This theory contains no provable formal statements.

C.129 Proofs for Memory_access_adt_reduce

(Memory_access_adt.pvs)

This theory contains no provable formal statements.

C.130 Proofs for Memory_access_util (result.pvs)

This theory contains no provable formal statements.

2579 C Proof scripts

C.131 Proofs for Memory_privilege (result.pvs)

This theory contains no provable formal statements.

C.132 Proofs for Memory_privilege_adt

(Memory_privilege_adt.pvs)

This theory contains no provable formal statements.

C.133 Proofs for Memory_privilege_adt_reduce

(Memory_privilege_adt.pvs)

This theory contains no provable formal statements.

C.134 Proofs for Memory_privilege_util (result.pvs)

C.134.1 Memory_privilege_util.bool_to_memory_privilege_iso

                                                                                                                        Terse proof for bool_to_memory_privilege_iso.
                                                                                                                        bool_to_memory_privilege_iso:

{1} ∀ (ar: Memory_privilege): bool_to_memory_privilege(memory_privilege_to_bool(ar)) = ar

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of bool_to_memory_privilege_iso.

Q.E.D.

C.135 Proofs for Min_Max_Extension

(vfiasco-prelude.pvs)

C.135.1 Min_Max_Extension.max_stable_under_extension_TCC1

                                                                                                                        Terse proof for max_stable_under_extension_TCC1.
                                                                                                                        max_stable_under_extension_TCC1:

{1} ∀ (P: non_empty_finite_set[S]): ¬ empty?[T ](extend[T, S, bool, false](P))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of max_stable_under_extension_TCC1.

Q.E.D.

C.135.2 Min_Max_Extension.max_stable_under_extension

                                                                                                                        Terse proof for max_stable_under_extension.

2580

C.135 Proofs for Min_Max_Extension (vfiasco-prelude.pvs)

max_stable_under_extension:

{1} ∀ (P: non_empty_finite_set[S]):

max[T, ≤](extend[T, S, bool, false](P)) = max[S, restrict[[T, T ], [S, S], boolean](≤)](P)

Repeatedly Skolemizing and flattening, Rewriting using max_lem, matching in *, Applying propositional simplification, we get 2 subgoals:

max_stable_under_extension.1:

{-1} is_finite[S](P′)

{1} extend[T, S, bool, false]

(P′)(max[S, restrict[[T, T ], [S, S], boolean](≤)](P′))

{2} empty?[S](P′)

Expanding the definition of extend, which is trivially true.

This completes the proof of max_stable_under_extension.1.
max_stable_under_extension.2:

{-1} is_finite[S](P′)
{1} ∀ (x: (extend[T, S, bool, false](P′))):
x ≤ max[S, restrict[[T, T ], [S, S], boolean](≤)](P′)
{2} empty?[S](P′)

Repeatedly Skolemizing and flattening, Expanding the definition of extend, Adding type constraints for max[S, restrict[[T, T], [S, S], boolean](<=)](P!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (x!1), Expanding the definition of restrict, which is trivially true.

This completes the proof of max_stable_under_extension.2.

Q.E.D.

C.135.3 Min_Max_Extension.min_stable_under_extension

Terse proof for min_stable_under_extension.
min_stable_under_extension:

{1} ∀ (P: non_empty_finite_set[S]):

min[T, ≤](extend[T, S, bool, false](P)) = min[S, restrict[[T, T ], [S, S], boolean](≤)](P)

Repeatedly Skolemizing and flattening, Rewriting using min_lem, matching in *, Expanding the definition of extend, Repeatedly Skolemizing and flattening, Adding type constraints for min[S, restrict[[T, T], [S, S], boolean](<=)](P!1), Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

C Proof scripts

Instantiating the top quantifier in -3 with the terms: (x!1),

Expanding the definition of restrict,

which is trivially true.

                                                                                                                   This completes the proof of min_stable_under_extension.

Q.E.D.

C.136 Proofs for More_Divides (vfiasco-prelude.pvs)

C.136.1 More_Divides.expt_divides

Terse proof for expt_divides.

                                                                                                                   expt_divides:

{1} ∀ (m, n: nat, a: posnat): a > 1 ∧ n ≤ m ⊃ divides(expt(a, n), expt(a, m))

Repeatedly Skolemizing and flattening, Expanding the definition of divides, Instantiating the top quantifier in 1 with the terms: expt(a′, m′ − n′), we get 2 subgoals:

                                                                                                                   expt_divides.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} a′ > 0
{-4} a′ > 1
{-5} n′ ≤ m′
{1} expt(a′, m′) = expt(a′, n′) × expt(a′, m′ − n′)

Rewriting using expt_plus_aux, matching in *, This completes the proof of expt_divides.1.

                                                                                                                   expt_divides.2:

\begin{matrix}\{-1\} & m′ ≥ 0 \\ \{-2\} & n′ ≥ 0 \\ \{-3\} & a′ > 0 \\ \{-4\} & a′ > 1 \\ \{-5\} & n′ ≤ m′ \\ \{1\} & m′ − n′ ≥ 0 \end{matrix}

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of expt_divides.2.

Q.E.D.

C.136.2 More_Divides.divides_expt_gt

                                                                                                                 Terse proof for divides_expt_gt.
                                                                                                                   divides_expt_gt:

{1} ∀ (n, i, j: nat): j ≤ i ∧ divides(expt(2, i), n) ⊃ divides(expt(2, j), n)

Repeatedly Skolemizing and flattening,

Applying divides_transitive

Instantiating the top quantifier in -1 with the terms: n′, expt(2, i′), expt(2, j′),

2582

C.137 Proofs for More_Function (vfiasco-prelude.pvs)

Simplifying, rewriting, and recording with decision procedures,

Rewriting using expt_divides, matching in *, This completes the proof of divides_expt_gt. Q.E.D.

C.137 Proofs for More_Function (vfiasco-prelude.pvs)

C.137.1 More_Function.restrict_to_image_TCC1

                                                                                                                        Terse proof for restrict_to_image_TCC1.
                                                                                                                        restrict_to_image_TCC1:

{1} ∀ (f: [Domain → Range]):

∀ (x_{1}: Domain): image[Domain, Range](f, fullset[Domain])(f(x_{1}))

Trying repeated skolemization, instantiation, and if-lifti

C.191 Proofs for Random_Device (random_device.pvs)

C.191.7 Random_Device.random_TCC1

Terse proof for random_TCC1.

random_TCC1:

{1} ∃ (x_{1}:

[[nat, nat] →

{l: list[Byte] | length[Byte](l) = size(uidt(dt_uint))}]):

true

Instantiating the top quantifier in 1 with the terms: (λ (n_{1}, n_{2}: nat): choose(λ (l: list[Byte]): length(l) = size(uidt(dt_uint)))),

we get 2 subgoals:

random_TCC1.1:

{1} true

which is trivially true. This completes the proof of random_TCC1.1.

random_TCC1.2:

{1} nonempty?[list[Byte]] (λ (l: list[Byte]): length[Byte](l) = size(uidt(dt_uint)))

Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Rewriting using forall_not, matching in *, Using lemma list_all_length[Byte], This completes the proof of random_TCC1.2. Q.E.D.

C.191.8 Random_Device.read_mem_cnt_TCC1

Terse proof for read_mem_cnt_TCC1.
read_mem_cnt_TCC1:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = mem_cnt ⊃ (∀ (s: Random_device_memory): non_bool_integral?(uint))

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_mem_cnt_TCC1. Q.E.D.

C.191.9 Random_Device.read_mem_cnt_TCC2

Terse proof for read_mem_cnt_TCC2.

2861 C Proof scripts

read_mem_cnt_TCC2:

{1} ∀ (a: Address, bl: list[Byte]): cons?(bl) ∧ a = mem_cnt ⊃ (∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Expanding the definition of max_value, Expanding the definition of range_integral, Using lemma max_uint, Using lemma max_uint_bits, Using lemma pos_expt_gt, Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = ex-

tend[real, nat, bool, FALSE](range_uint), we get 2 subgoals:

read_mem_cnt_TCC2.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint)

{-2} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-3} max_value_bits_uint ≥ 16
{-4} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Replacing using formula -1, Using lemma max_stable_under_extension[real, nat, ≤], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_mem_cnt_TCC2.1.

read_mem_cnt_TCC2.2:

{-1} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-2} max_value_bits_uint ≥ 16
{-3} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_mem_cnt_TCC2.2. Q.E.D.

C.191.10 Random_Device.read_mem_cnt_TCC3

Terse proof for read_mem_cnt_TCC3.

2862

C.191 Proofs for Random_Device (random_device.pvs)

read_mem_cnt_TCC3:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = mem_cnt ⊃ (∀ (s: Random_device_memory):

(range_uint)(rem(max_value(uint))

(access_count(s) − counter_offset(s))))

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Adding type constraints for rem(max_value(uint))(access_count(s!1) - counter_offset(s!1)), we get 2 subgoals:

read_mem_cnt_TCC3.1:

{-1} rem(max_value(uint))(access_count(s′) − counter_offset(s′)) < max_value(uint)

{-2} ∃ q:

access_count(s′) − counter_offset(s′) = rem(max_value(uint))(access_count(s′) − counter_offset(s′)) + max_value(uint) × q

{1} (range_uint)(rem(max_value(uint))(access_count(s′) − counter_offset(s′)))

Using lemma binary_range_uint, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-1 2) and hiding *, Expanding the definition of max_value, Expanding the definition of range_integral, Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = ex-

tend[real, nat, bool, FALSE](range_uint), we get 2 subgoals:

read_mem_cnt_TCC3.1.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {-2} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{1} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) ≤ max(range_uint)

Replacing using formula -1, Using lemma max_stable_under_extension[real, nat, ≤], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_mem_cnt_TCC3.1.1.

read_mem_cnt_TCC3.1.2:

{-1} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) ≤ max(range_uint)

Keeping (1) and hiding *,

2863 C Proof scripts

Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_mem_cnt_TCC3.1.2.

read_mem_cnt_TCC3.2:

{1} max_value(uint) ≥ 0
{2} (range_uint)(rem(max_value(uint))(access_count(s′) − counter_offset(s′)))

Using lemma read_mem_cnt_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_mem_cnt_TCC3.2. Q.E.D.

C.191.11 Random_Device.read_seed_TCC1

Terse proof for read_seed_TCC1.
read_seed_TCC1:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = rnd_seed ⊃ (∀ (s: Random_device_memory): non_bool_integral?(uint))

Repeatedly Skolemizing and flattening, Expanding the definition of non_bool_integral?, Expanding the definition of unsigned_integer?, which is trivially true. This completes the proof of read_seed_TCC1. Q.E.D.

C.191.12 Random_Device.read_seed_TCC2

Terse proof for read_seed_TCC2.
read_seed_TCC2:

{1} ∀ (a: Address, bl: list[Byte]): cons?(bl) ∧ a = rnd_seed ⊃ (∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Using lemma max_uint, Using lemma max_uint_bits, Using lemma pos_expt_gt, Expanding the definition of max_value, Expanding the definition of range_integral, Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = ex-

tend[real, nat, bool, FALSE](range_uint), we get 2 subgoals:

2864

C.191 Proofs for Random_Device (random_device.pvs)

read_seed_TCC2.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint)

{-2} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-3} max_value_bits_uint ≥ 16
{-4} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Replacing using formula -1,

Using lemma max_stable_under_extension[real, nat, ≤],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of read_seed_TCC2.1.

read_seed_TCC2.2:

{-1} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-2} max_value_bits_uint ≥ 16
{-3} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Keeping (1) and hiding *,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of read_seed_TCC2.2.

Q.E.D.

C.191.13 Random_Device.read_seed_TCC3

Terse proof for read_seed_TCC3.
read_seed_TCC3:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = rnd_seed ⊃ (∀ (s: Random_device_memory): (range_uint)(rem(max_value(uint))(seed(s))))

Repeatedly Skolemizing and flattening,

Using lemma read_seed_TCC2,

Using lemma binary_range_uint,

we get 2 subgoals:

2865 C Proof scripts

read_seed_TCC3.1:

{-1} range_uint(rem(max_value(uint))(seed(s′))) ≡

rem(max_value(uint))(seed(s′)) ≤ max(range_uint) {-2} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-3} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-4} cons?(bl′)
{-5} a′ = rnd_seed
{1} (range_uint)(rem(max_value(uint))(seed(s′)))

Adding type constraints for rem(max_value(uint))(seed(s!1)),

we get 2 subgoals:

read_seed_TCC3.1.1:

{-1} rem(max_value(uint))(seed(s′)) < max_value(uint)
{-2} ∃ q: seed(s′) = rem(max_value(uint))(seed(s′)) + max_value(uint) × q

{-3} range_uint(rem(max_value(uint))(seed(s′))) ≡

rem(max_value(uint))(seed(s′)) ≤ max(range_uint) {-4} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-6} cons?(bl′)
{-7} a′ = rnd_seed
{1} (range_uint)(rem(max_value(uint))(seed(s′)))

Expanding the definition of max_value,

Expanding the definition of range_integral,

Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = extend[real, nat, bool, FALSE](range_uint),

we get 2 subgoals:

2866

C.191 Proofs for Random_Device (random_device.pvs)

read_seed_TCC3.1.1.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {-2} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{-3} ∃ q:

seed(s′) = rem(max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))))(seed(s′)) + max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))) × q

{-4} range_uint(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

≡ rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) ≤ max(range_uint)

{-5} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory):

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0)

{-6} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-7} cons?(bl′)
{-8} a′ = rnd_seed

{1} (range_uint)(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

Using lemma max_stable_under_extension[real, nat, ≤],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of read_seed_TCC3.1.1.1.

2867 C Proof scripts

read_seed_TCC3.1.1.2:

{-1} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{-2} ∃ q:

seed(s′) = rem(max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))))(seed(s′)) + max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))) × q

{-3} range_uint(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

≡ rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) ≤ max(range_uint)

{-4} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory):

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0)

{-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-6} cons?(bl′)
{-7} a′ = rnd_seed

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} (range_uint)(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_seed_TCC3.1.1.2.

read_seed_TCC3.1.2:

{-1} range_uint(rem(max_value(uint))(seed(s′))) ≡

rem(max_value(uint))(seed(s′)) ≤ max(range_uint) {-2} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-3} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-4} cons?(bl′)
{-5} a′ = rnd_seed
{1} max_value(uint) ≥ 0
{2} (range_uint)(rem(max_value(uint))(seed(s′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2868

C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs)

This completes the proof of read_seed_TCC3.1.2.

read_seed_TCC3.2:

{-1} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-2} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-3} cons?(bl′)
{-4} a′ = rnd_seed
{1} max_value(uint) ≥ 0
{2} (range_uint)(rem(max_value(uint))(seed(s′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_seed_TCC3.2. Q.E.D.

C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs)

C.192.1 Read_After_Write_Fails.plain_mem_write_list_states_TCC1

Terse proof for plain_mem_write_list_states_TCC1.
plain_mem_write_list_states_TCC1:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃ OK?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states_TCC1.

Q.E.D.

C.192.2 Read_After_Write_Fails.plain_mem_write_list_states

Terse proof for plain_mem_write_list_states.

2869 C Proof scripts

plain_mem_write_list_states:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃ pm`states(state(memory_write_list(pm`mem)(a, bl)(s)))

Repeatedly Skolemizing and flattening, Using lemma transformer_invariant_write_list[State], Replacing using formula -4, Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -4, Replacing using formula -3, Replacing using formula -6, Replacing using formula -1, Rewriting using add_as_union, matching in *, Rewriting using transformer_invariant_union_transformers, matching in *, we get 3 subgoals:

plain_mem_write_list_states.1:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))
{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))
{1} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states.1.
plain_mem_write_list_states.2:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

memory_write_transformers(pm′`mem,

ad-

dress_block(a′, length(bl′))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_invariant_write_block,

2870

C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs)

Replacing using formula -5, Replacing using formula -7, which is trivially true.

This completes the proof of plain_mem_write_list_states.2.
plain_mem_write_list_states.3:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

singleton(expr_2_super(memory_write_side_effect(pm′`mem)

(a′, bl′, false))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_transformer_invariant_write_side_effects, Replacing using formula -5, Replacing using formula -7, Applying transformer_invariant_mono_transformers where transformers_1 gets singleton(expr_2_super(memory_write_side_effect(pm!1‘mem)

(a!1, bl!1, FALSE))), transformers_2 gets memory_write_side_effect_super_transformers(pm!1‘mem, address_block (a!1, length(bl!1))),

Instantiating quantified variables, Replacing using formula -2, Hiding formulas: -2, -3, -4, 2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Expanding the definition of subset?, Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of singleton, Expanding the definition of member, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states.3.

Q.E.D.

C.192.3 Read_After_Write_Fails.plain_mem_write_list_read_list_ok

Terse proof for plain_mem_write_list_read_list_ok.

2871 C Proof scripts

plain_mem_write_list_read_list_ok:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃ OK?(memory_read_list(pm`mem)(a, size)

(state(memory_write_list(pm`mem)(a, bl)(s))))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_ok[State], Using lemma plain_memory_transformer_invariant_read_list_block, Replacing using formula -4, Applying subset_bigger_union_right where a gets address_block(a!1, size!1), b gets pm!1‘ro_addr, c

gets pm!1‘rw_addr, Replacing using formula -7, Replacing using formula -1, Replacing using formula -2, Using lemma plain_memory_transformers_ok_read_list_block, Replacing using formula -6, Replacing using formula -2, Replacing using formula -1, Using lemma plain_mem_write_list_states, Replacing using formula -6, Replacing using formula -7, Replacing using formula -8, Replacing using formula -9, Replacing using formula -10, Replacing using formula -1, which is trivially true.

This completes the proof of plain_mem_write_list_read_list_ok.

Q.E.D.

C.192.4 Read_After_Write_Fails.Fatal_Result

Terse proof for Fatal_Result.

Fatal_Result:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(pod_1, a, pm`rw_addr) ⊃ Fatal?((write_data(pm, pod_1)(a, unit) ## read_data(pm, pod_2)(a))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: write_data in_blessed_memory? pod_1 pod_2 length read_data

uidt_1 uidt_2 ## Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_write_list_ok[State], Using lemma plain_memory_transformer_invariant_write_list_block, Using lemma plain_memory_transformers_ok_write_list_block,

2872

C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs)

Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -5, Replacing using formula -6, Expanding the definition of length, Expanding the definition of length, Replacing using formula -1, Replacing using formula -2, Replacing using formula -3, Using lemma plain_mem_write_list_read_list_ok, Using lemma plain_mem_write_list_read_list, Expanding the definition of ok_lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -6, Keeping (-10) and hiding *, Using lemma list_cons_eta, Using lemma list_cons_eta, Replacing using formula -2, Replacing using formula -1, Keeping (-3) and hiding *, Applying decompose-equality, This completes the proof of Fatal_Result. Q.E.D.

C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs)

C.193.1 Read_After_Write_Fails_2.plain_mem_write_list_states_TCC1

Terse proof for plain_mem_write_list_states_TCC1.
plain_mem_write_list_states_TCC1:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃

OK?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states_TCC1.

Q.E.D.

C.193.2 Read_After_Write_Fails_2.plain_mem_write_list_states

Terse proof for plain_mem_write_list_states.

2873 C Proof scripts

                                                                                                                   plain_mem_write_list_states:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃ pm`states(state(memory_write_list(pm`mem)(a, bl)(s)))

Repeatedly Skolemizing and flattening,

Using lemma transformer_invariant_write_list[State],

Replacing using formula -4,

Using lemma plain_memory_side_effect_content_unchanged_write_block,

Replacing using formula -4, Replacing using formula -3, Replacing using formula -6, Replacing using formula -1, Rewriting using add_as_union, matching in *, Rewriting using transformer_invariant_union_transformers, matching in *, we get 3 subgoals:

                                                                                                                   plain_mem_write_list_states.1:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))
{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))
{1} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                   This completes the proof of plain_mem_write_list_states.1.
                                                                                                                   plain_mem_write_list_states.2:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

memory_write_transformers(pm′`mem,

ad-

dress_block(a′, length(bl′))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_invariant_write_block,

2874

C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs)

Replacing using formula -5, Replacing using formula -7, which is trivially true.

                                                                                                                        This completes the proof of plain_mem_write_list_states.2.
                                                                                                                        plain_mem_write_list_states.3:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

singleton(expr_2_super(memory_write_side_effect(pm′`mem)

(a′, bl′, false))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_transformer_invariant_write_side_effects,

Replacing using formula -5, Replacing using formula -7, Applying transformer_invariant_mono_transformers where transformers_1 gets singleton(expr_2_super(memory_write_side_effect(pm!1‘mem)

(a!1, bl!1, FALSE))), transformers_2 gets memory_write_side_effect_super_transformers(pm!1‘mem, ad-

dress_block (a!1, length(bl!1))), Instantiating quantified variables, Replacing using formula -2, Hiding formulas: -2, -3, -4, 2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Expanding the definition of subset?, Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of singleton, Expanding the definition of member, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of plain_mem_write_list_states.3.

Q.E.D.

C.193.3 Read_After_Write_Fails_2.plain_mem_write_list_read_list_ok

                                                                                                                        Terse proof for plain_mem_write_list_read_list_ok.

2875 C Proof scripts

                                                                                                                        plain_mem_write_list_read_list_ok:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃

OK?(memory_read_list(pm`mem)(a, size)

(state(memory_write_list(pm`mem)(a, bl)(s))))

Repeatedly Skolemizing and flattening,

Using lemma memory_read_list_ok[State],

Using lemma plain_memory_transformer_invariant_read_list_block,

Replacing using formula -4,

Applying subset_bigger_union_right where a gets address_block(a!1, size!1), b gets pm!1‘ro_addr, c gets pm!1‘rw_addr,

Replacing using formula -7, Replacing using formula -1, Replacing using formula -2, Using lemma plain_memory_transformers_ok_read_list_block, Replacing using formula -6, Replacing using formula -2, Replacing using formula -1, Using lemma plain_mem_write_list_states, Replacing using formula -6, Replacing using formula -7, Replacing using formula -8, Replacing using formula -9, Replacing using formula -10, Replacing using formula -1, which is trivially true.

                                                                                                                        This completes the proof of plain_mem_write_list_read_list_ok.

Q.E.D.

C.193.4 Read_After_Write_Fails_2.Fatal_Result

Terse proof for Fatal_Result.

                                                                                                                        Fatal_Result:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(pod_bool, a, pm`rw_addr) ⊃ Fatal?((write_data(pm, pod_bool)(a, true) ## read_data(pm, pod_Byte)(a))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of write_data, Expanding the definition of write_data, Expanding the definition of in_blessed_memory?, Expanding the definition of pod_bool, Expanding the definition of ##, Expanding the definition of ##,

2876

C.194 Proofs for Register_Id (constants.pvs)

Using lemma memory_write_list_ok[State],

Using lemma plain_memory_transformer_invariant_write_list_block,

Expanding the definition of uidt_bool, Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, Replacing using formula -3, Replacing using formula -5, Replacing using formula -1, Using lemma plain_memory_transformers_ok_write_list_block, Replacing using formula -4, Replacing using formula -6, Replacing using formula -1, Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -5, Replacing using formula -7, Replacing using formula -1, Replacing using formula -6, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of read_data, Expanding the definition of read_data, Expanding the definition of pod_Byte, Expanding the definition of uidt_Byte, Expanding the definition of ##, Using lemma plain_mem_write_list_read_list_ok, Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_mem_write_list_read_list, Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, Replacing using formula -1, Expanding the definition of ok_lift, which is trivially true. This completes the proof of Fatal_Result. Q.E.D.

C.194 Proofs for Register_Id (constants.pvs)

This theory contains no provable formal statements.

C.195 Proofs for Register_Id_adt (Register_Id_adt.pvs)

This theory contains no provable formal statements.

2877 C Proof scripts

C.196 Proofs for Register_Id_adt_reduce

(Register_Id_adt.pvs)

This theory contains no provable formal statements.

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

C.197.1 Rewrite_Test.rewrite_test

Terse proof for rewrite_test.

                                                                                                                        rewrite_test:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧

in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

OK?((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1)) (s))

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test.

Q.E.D.

C.197.2 Rewrite_Test.rewrite_test_data_TCC1

                                                                                                                        Terse proof for rewrite_test_data_TCC1.

2878

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

                                                                                                                        rewrite_test_data_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

pm`states(s) ∧

blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃

OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Unit, Unit]

(write_data[State, Data1](pm, dt1)(addr1, data1), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), read_data[State, Data1](pm, dt1)(addr1)))

(s))

Repeatedly Skolemizing and flattening,

Rewriting using rewrite_test, matching in *,

This completes the proof of rewrite_test_data_TCC1.

Q.E.D.

C.197.3 Rewrite_Test.rewrite_test_data

                                                                                                                        Terse proof for rewrite_test_data.
                                                                                                                        rewrite_test_data:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧

in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1)) (s))

= data1

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr

2879 C Proof scripts

plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read

pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data.

Q.E.D.

C.197.4 Rewrite_Test.rewrite_test_data_long_TCC1

                                                                                                                        Terse proof for rewrite_test_data_long_TCC1.

2880

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

rewrite_test_data_long_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): pm`states(s) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃ OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Data2, Unit]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Data2, Unit]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Data2, Unit]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(## [State, Unit, Data1] (##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Unit, Unit]

(write_data

[State,

Data1] (pm,

dt1) (addr1,

data1), write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data1] (pm,

dt1) (addr1)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data2] (pm,

dt2) (addr2)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data1] (pm,

dt1) (addr1)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data2] (pm,

dt2) (addr2)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data1] (pm,

dt1) (addr1)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data2] (pm,

dt2) (addr2)),

write_data [State,

Data2] (pm, dt2) (addr2,

data2)), read_data [State,

Data1] (pm, dt1) (addr1)),

write_data [State,

Data2] (pm, dt2) (addr2,

data2)), read_data [State, Data2] (pm, dt2) (addr2)),

write_data [State, Data2] (pm, dt2) (addr2,

data2)), read_data [State, Data1] (pm, dt1) (addr1)),

write_data [State, Data2] (pm, dt2) (addr2, data2)),

read_data[State, Data2] (pm, dt2)(addr2)),

write_data[State, Data2] (pm, dt2) (addr2, data2)),

read_data[State, Data1] (pm, dt1)(addr1)),

write_data[State, Data2] (pm, dt2)(addr2, data2)),

read_data[State, Data2] (pm, dt2)(addr2)),

write_data[State, Data2] (pm, dt2)(addr2, data2)),

read_data[State, Data1]

(pm, dt1)(addr1)),

write_data[State, Data2]

(pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), read_data[State, Data1](pm, dt1)(addr1)))

(s))

2881 C Proof scripts

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_long_TCC1.

Q.E.D.

C.197.5 Rewrite_Test.rewrite_test_data_long

Terse proof for rewrite_test_data_long.

2882

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

rewrite_test_data_long:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃ data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ##

read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1)) (s))

= data1

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr

2883 C Proof scripts

plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of rewrite_test_data_long. Q.E.D.

C.197.6 Rewrite_Test.rewrite_test_data_eval_if_ok_ok

Terse proof for rewrite_test_data_eval_if_ok_ok.
rewrite_test_data_eval_if_ok_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃ OK?((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ##

read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): read_data(pm, dt1)(addr1))) (s))

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok

ok_result_q_data different_registers_blocks_disjoint Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_eval_if_ok_ok.

Q.E.D.

2884

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

C.197.7 Rewrite_Test.rewrite_test_data_eval_if_ok_TCC1

Terse proof for rewrite_test_data_eval_if_ok_TCC1.
rewrite_test_data_eval_if_ok_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): pm`states(s) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃ OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Unit, Unit]

(write_data[State, Data1](pm, dt1)(addr1, data1),

write_data[State, Data2](pm, dt2)(addr2, data2)), read_data[State, Data1](pm, dt1)(addr1)),

write_data[State, Data2](pm, dt2)(addr2, data2)), read_data[State, Data2](pm, dt2)(addr2)),

λ (d: Data2): read_data[State, Data1](pm, dt1)(addr1))) (s))

Repeatedly Skolemizing and flattening, Rewriting using rewrite_test_data_eval_if_ok_ok, matching in *,

This completes the proof of rewrite_test_data_eval_if_ok_TCC1.

Q.E.D.

C.197.8 Rewrite_Test.rewrite_test_data_eval_if_ok

Terse proof for rewrite_test_data_eval_if_ok.
rewrite_test_data_eval_if_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃ data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ##

read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): read_data(pm, dt1)(addr1))) (s))

= data1

2885 C Proof scripts

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok

ok_result_q_data different_registers_blocks_disjoint Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_eval_if_ok.

Q.E.D.

C.197.9 Rewrite_Test.rewrite_test_data_eval_if_ok_ok_result_ok

Terse proof for rewrite_test_data_eval_if_ok_ok_result_ok.
rewrite_test_data_eval_if_ok_ok_result_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃ OK?[State, Data2]

((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): ok_result(d))) (s))

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

2886

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok ok_result_q_data different_registers_blocks_disjoint

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_eval_if_ok_ok_result_ok.

Q.E.D.

C.197.10 Rewrite_Test.rewrite_test_data_eval_if_ok_ok_result_TCC1

Terse proof for rewrite_test_data_eval_if_ok_ok_result_TCC1.
rewrite_test_data_eval_if_ok_ok_result_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): pm`states(s) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃ OK?[State, Data2]

((##[State, Data2, Data2]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Unit, Unit]

(write_data[State, Data1](pm, dt1)(addr1, data1),

write_data[State, Data2](pm, dt2)(addr2, data2)), read_data[State, Data1](pm, dt1)(addr1)),

write_data[State, Data2](pm, dt2)(addr2, data2)), read_data[State, Data2](pm, dt2)(addr2)),

λ (d: Data2): ok_result[State, Data2](d))) (s))

Repeatedly Skolemizing and flattening,

Rewriting using rewrite_test_data_eval_if_ok_ok_result_ok, matching in *,

This completes the proof of rewrite_test_data_eval_if_ok_ok_result_TCC1.

Q.E.D.

C.197.11 Rewrite_Test.rewrite_test_data_eval_if_ok_ok_result

Terse proof for rewrite_test_data_eval_if_ok_ok_result.

2887 C Proof scripts

rewrite_test_data_eval_if_ok_ok_result:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃ data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ##

read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): ok_result(d))) (s))

= data2

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok

ok_result_q_data different_registers_blocks_disjoint Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_eval_if_ok_ok_result.

Q.E.D.

C.198 Proofs for Search_Example (search-example.pvs)

C.198.1 Search_Example.value_TCC1

Terse proof for value_TCC1.

value_TCC1:

{1} ∃ (x: (range(uint))): true

Instantiating the top quantifier in 1 with the terms: (0), we get 2 subgoals:

value_TCC1.1:

{1} true

2888

C.198 Proofs for Search_Example (search-example.pvs)

which is trivially true. This completes the proof of value_TCC1.1.

value_TCC1.2:

{1} range(uint)(0)

Trying repeated skolemization, instantiation, and if-lifting, Rewriting using binary_range_uint, matching in *, Using lemma max_uint, Using lemma max_uint_bits, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of value_TCC1.2. Q.E.D.

C.198.2 Search_Example.Search_Pre_TCC1

Terse proof for Search_Pre_TCC1.
Search_Pre_TCC1:

{1} Cpp_Type?(uint) ∧ cv(non_bool_integral_enum?)(uint)

Applying propositional simplification, we get 2 subgoals:

Search_Pre_TCC1.1:

{1} Cpp_Type?(uint)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC1.1.

Search_Pre_TCC1.2:

{1} cv(non_bool_integral_enum?)(uint)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Search_Pre_TCC1.2. Q.E.D.

C.198.3 Search_Example.Search_Pre_TCC2

Terse proof for Search_Pre_TCC2.

2889 C Proof scripts

Search_Pre_TCC2:

{1} ∀ (s: State):

pm`states(s) ∧ plain_memory?(pm) ⊃ Cpp_Type?(pointer(uint)) ∧ cv(pointer?)(pointer(uint))

Repeatedly Skolemizing and flattening,

Keeping (1) and hiding *,

Applying propositional simplification,

we get 2 subgoals:

Search_Pre_TCC2.1:

{1} Cpp_Type?(pointer(uint))

Expanding the definition of Cpp_Type?,

Expanding the definition of subterm,

Repeatedly Skolemizing and flattening,

Expanding the definition of subterm,

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Splitting conjunctions,

we get 2 subgoals:

2890

C.198 Proofs for Search_Example (search-example.pvs)

Search_Pre_TCC2.1.1:

{-1} t′ = pointer(uint)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of Search_Pre_TCC2.1.1.

2891 C Proof scripts

Search_Pre_TCC2.1.2:

{-1} t′ = uint

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC2.1.2.

Search_Pre_TCC2.2:

{1} cv(pointer?)(pointer(uint))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Search_Pre_TCC2.2. Q.E.D.

C.198.4 Search_Example.Search_Pre_TCC3

Terse proof for Search_Pre_TCC3.
Search_Pre_TCC3:

{1} ∀ (s: State): pm`states(s) ∧ plain_memory?(pm) ⊃ Cpp_Type?(pointer(uint))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC3.

2892

C.198 Proofs for Search_Example (search-example.pvs)

Q.E.D.

C.198.5 Search_Example.Search_Pre_TCC4

Terse proof for Search_Pre_TCC4.
Search_Pre_TCC4:

{1} ∀ (s: State): pm`states(s) ∧ plain_memory?(pm) ⊃ pointer?(cv_base(pointer(uint)))

Repeatedly Skolemizing and flattening,

Rewriting using cv_base_result, matching in *,

we get 2 subgoals:

Search_Pre_TCC4.1:

{-1} pm`states(s′)
{-2} plain_memory?(pm)
{1} cv(pointer?)(pointer(uint))
{2} pointer?(cv_base(pointer(uint)))

Using lemma Search_Pre_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of Search_Pre_TCC4.1.

Search_Pre_TCC4.2:

{-1} pm`states(s′)
{-2} plain_memory?(pm)
{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(pointer(uint)))

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of Search_Pre_TCC4.2.

Q.E.D.

C.198.6 Search_Example.Search_Pre_TCC5

Terse proof for Search_Pre_TCC5.

2893 C Proof scripts

                                                                                                                   Search_Pre_TCC5:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(first)(s))

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_read_data_ok, matching in *,

This completes the proof of Search_Pre_TCC5.

Q.E.D.

C.198.7 Search_Example.Search_Pre_TCC6

                                                                                                                 Terse proof for Search_Pre_TCC6.
                                                                                                                   Search_Pre_TCC6:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(last)(s)))

2894

C.198 Proofs for Search_Example (search-example.pvs)

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_read_data_ok, matching in *,

This completes the proof of Search_Pre_TCC6.

Q.E.D.

C.198.8 Search_Example.Search_Pre_TCC7

                                                                                                                        Terse proof for Search_Pre_TCC7.
                                                                                                                        Search_Pre_TCC7:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (last_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(last_value) ∧ not_null?(pointer(uint))(first_value) ∧ last_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ⊃ (∀ (i: below[N]): Cpp_Type?(uint))))

Repeatedly Skolemizing and flattening,

Using lemma Search_Pre_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of Search_Pre_TCC7.

Q.E.D.

C.198.9 Search_Example.Search_Pre_TCC8

                                                                                                                        Terse proof for Search_Pre_TCC8.

2895 C Proof scripts

                                                                                                                        Search_Pre_TCC8:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (last_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(last_value) ∧ not_null?(pointer(uint))(first_value) ∧ last_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ⊃ (∀ (i: below[N]): up?[Memory_Address] (address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))))))

Repeatedly Skolemizing and flattening,

Rewriting using address_of_spec, matching in *,

Keeping (-17 1) and hiding *,

Using lemma add_spec,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of Search_Pre_TCC8.

Q.E.D.

C.198.10 Search_Example.Search_Pre_TCC9

                                                                                                                        Terse proof for Search_Pre_TCC9.

2896

C.198 Proofs for Search_Example (search-example.pvs)

                                                                                                                        Search_Pre_TCC9:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (last_value: ((range_pointer(cv_base(pointer(uint)))))): (∀ (i: below[N]): valid_in_mem(pm, dt(uint)) (down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint))))) (s)) ∧ (∀ (i: below[N]): blocks_disjoint?(current, size_of(pointer(uint)), down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))), size_of(uint))) ∧ (∀ (i: below[N]): blocks_disjoint?(down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))), size_of(uint), current, size_of(pointer(uint)))) ∧ (∀ (i: below[N]): in_blessed_memory?[(range(uint))] (dt(uint), down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))), (pm‘ro_addr∪ pm‘rw_addr))) ∧ not_null?(pointer(uint))(last_value) ∧ not_null?(pointer(uint))(first_value) ∧ last_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ⊃ Cpp_Type?(uint)))

2897 C Proof scripts

Repeatedly Skolemizing and flattening,

Using lemma Search_Pre_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of Search_Pre_TCC9.

Q.E.D.

C.198.11 Search_Example.search_TCC1

Terse proof for search_TCC1.

                                                                                                                        search_TCC1:

{1} Cpp_Type?(pointer(uint)) ∧ cv(pointer?)(pointer(uint))

Applying propositional simplification,

we get 2 subgoals:

                                                                                                                        search_TCC1.1:

{1} Cpp_Type?(pointer(uint))

Expanding the definition of Cpp_Type?,

Repeatedly Skolemizing and flattening,

Expanding the definition of subterm,

Expanding the definition of subterm,

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Splitting conjunctions,

we get 2 subgoals:

2898

C.198 Proofs for Search_Example (search-example.pvs)

                                                                                                                        search_TCC1.1.1:

{-1} t′ = pointer(uint)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of search_TCC1.1.1.

2899 C Proof scripts

                                                                                                                        search_TCC1.1.2:

{-1} t′ = uint

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_TCC1.1.2.

                                                                                                                        search_TCC1.2:

{1} cv(pointer?)(pointer(uint))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of search_TCC1.2.

Q.E.D.

C.198.12 Search_Example.search_TCC2

Terse proof for search_TCC2.

                                                                                                                        search_TCC2:

{1} Cpp_Type?(pointer(uint))

Using lemma search_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_TCC2.

Q.E.D.

2900

C.198 Proofs for Search_Example (search-example.pvs)

C.198.13 Search_Example.search_TCC3

Terse proof for search_TCC3.

search_TCC3:

{1} pointer?(cv_base(pointer(uint)))

Rewriting using cv_base_result, matching in *, we get 2 subgoals:

search_TCC3.1:

{1} cv(pointer?)(pointer(uint))
{2} pointer?(cv_base(pointer(uint)))

Using lemma search_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_TCC3.1.

search_TCC3.2:

{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(pointer(uint)))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of search_TCC3.2. Q.E.D.

C.198.14 Search_Example.search_TCC4

Terse proof for search_TCC4.

search_TCC4:

{1} Cpp_Type?(pointer(uint)) ∧ v(pointer?)(pointer(uint))

Applying propositional simplification, we get 2 subgoals:

search_TCC4.1:

{1} Cpp_Type?(pointer(uint))

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of subterm, Splitting conjunctions,

2901 C Proof scripts

we get 2 subgoals:

search_TCC4.1.1:

{-1} t′ = pointer(uint)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of search_TCC4.1.1.

2902

C.198 Proofs for Search_Example (search-example.pvs)

search_TCC4.1.2:

{-1} t′ = uint

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_TCC4.1.2.

search_TCC4.2:

{1} v(pointer?)(pointer(uint))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of search_TCC4.2. Q.E.D.

C.198.15 Search_Example.deref_current_TCC1

Terse proof for deref_current_TCC1.
deref_current_TCC1:

{1} ∀ (s: State):

read_current(s) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(current)(s))

2903 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of deref_current_TCC1. Q.E.D.

C.198.16 Search_Example.deref_current_TCC2

Terse proof for deref_current_TCC2.
deref_current_TCC2:

{1} ∀ (s: State): read_current(s) ⊃ (∀ (current_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(current_value) ∧ current_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(current)(s)) ⊃ up?[Memory_Address](address_of(pointer(uint))(current_value)))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, This completes the proof of deref_current_TCC2. Q.E.D.

C.198.17 Search_Example.read_array_TCC1

Terse proof for read_array_TCC1.
read_array_TCC1:

{1} ∀ (s: State):

read_first(s) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(first)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of read_first, which is trivially true. This completes the proof of read_array_TCC1. Q.E.D.

C.198.18 Search_Example.read_array_TCC2

Terse proof for read_array_TCC2.
read_array_TCC2:

{1} ∀ (s: State):

read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

not_null?(pointer(uint))(first_value) ∧ first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]): Cpp_Type?(uint)))

Repeatedly Skolemizing and flattening,

2904

C.198 Proofs for Search_Example (search-example.pvs)

Using lemma Search_Pre_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_array_TCC2. Q.E.D.

C.198.19 Search_Example.read_array_TCC3

Terse proof for read_array_TCC3.
read_array_TCC3:

{1} ∀ (s: State):

read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

not_null?(pointer(uint))(first_value) ∧ first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]):

up?[Memory_Address]

(address_of(pointer(uint))

(add(pointer(uint)) (first_value, i × size_of(uint))))))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_array_TCC3. Q.E.D.

C.198.20 Search_Example.not_found_TCC1

Terse proof for not_found_TCC1.
not_found_TCC1:

{1} ∀ (s: State):

read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]): Cpp_Type?(uint)))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of not_found_TCC1. Q.E.D.

C.198.21 Search_Example.not_found_TCC2

Terse proof for not_found_TCC2.

2905 C Proof scripts

not_found_TCC2:

{1} ∀ (s: State):

read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]):

up?[Memory_Address]

(address_of(pointer(uint))

(add(pointer(uint))

(first_value, i × size_of(uint))))))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of read_array, which is trivially true. This completes the proof of not_found_TCC2. Q.E.D.

C.198.22 Search_Example.not_found_TCC3

Terse proof for not_found_TCC3.
not_found_TCC3:

{1} ∀ (s: State):

read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]):

OK?[State, ((range(uint)))]

(read_data[State, ((range(uint)))] (pm[State], dt(uint)) (down[Memory_Address]

(address_of(pointer(uint))

(add(pointer(uint))

(first_value, i × size_of(uint)))))

(s))))

Repeatedly Skolemizing and flattening, Expanding the definition of read_array, Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, This completes the proof of not_found_TCC3. Q.E.D.

C.198.23 Search_Example.not_found_TCC4

Terse proof for not_found_TCC4.

2906

C.198 Proofs for Search_Example (search-example.pvs)

not_found_TCC4:

{1} ∀ (s: State): read_first(s) ∧ read_current(s) ∧ read_last(s) ∧ read_array(s) ∧ (let first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) in ∀ (i: below[N]): (data(read_data(pm, dt(uint)) (down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint))))) (s)) ≠ value)) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(last)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of read_last, which is trivially true. This completes the proof of not_found_TCC4. Q.E.D.

C.198.24 Search_Example.found_TCC1

Terse proof for found_TCC1.

found_TCC1:

{1} ∀ (s: State):

deref_current(s) ∧ read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(last)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of read_last, which is trivially true. This completes the proof of found_TCC1. Q.E.D.

C.198.25 Search_Example.found_TCC2

Terse proof for found_TCC2.

2907 C Proof scripts

found_TCC2:

{1} ∀ (s: State): read_first(s) ∧ read_current(s) ∧ read_last(s) ∧ read_array(s) ∧ deref_current(s) ∧ data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ≠ data(read_data(pm, dt_cv_pointer(pointer(uint)))(current)(s)) ⊃ up?[Memory_Address] (address_of(pointer(uint)) (data[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(current) (s))))

Repeatedly Skolemizing and flattening,

Expanding the definition of deref_current,

Applying disjunctive simplification to flatten sequent,

Rewriting using address_of_spec, matching in *,

Expanding the definition of cv_base,

which is trivially true.

This completes the proof of found_TCC2.

Q.E.D.

C.198.26 Search_Example.found_TCC3

Terse proof for found_TCC3.

2908

C.198 Proofs for Search_Example (search-example.pvs)

found_TCC3:

{1} ∀ (s: State):

read_first(s) ∧ read_current(s) ∧ read_last(s) ∧ read_array(s) ∧ deref_current(s) ∧ data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ≠ data(read_data(pm, dt_cv_pointer(pointer(uint)))(current)(s))

⊃ OK?[State, ((range(uint)))]

(read_data[State, ((range(uint)))] (pm[State], dt(uint)) (down[Memory_Address]

(address_of(pointer(uint))

(data[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data

[State,

((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint))) (current)(s)))))

(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of found_TCC3. Q.E.D.

C.198.27 Search_Example.uchar_range_values_TCC1

Terse proof for uchar_range_values_TCC1.
uchar_range_values_TCC1:

{1} ∀ (n: nat): n ≤ 255 ⊃ Cpp_Type?(uchar) ∧ cv(non_bool_integral_enum?)(uchar)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

uchar_range_values_TCC1.1:

{-1} n′ ≥ 0
{-2} n′ ≤ 255
{1} Cpp_Type?(uchar)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array?

2909 C Proof scripts

enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of uchar_range_values_TCC1.1.
uchar_range_values_TCC1.2:

{-1} n′ ≥ 0
{-2} n′ ≤ 255
{1} cv(non_bool_integral_enum?)(uchar)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of uchar_range_values_TCC1.2.

Q.E.D.

C.198.28 Search_Example.uchar_range_values

Terse proof for uchar_range_values.
uchar_range_values:

{1} ∀ (n: nat): n ≤ 255 ⊃ range(uchar)(n)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Expanding the definition of range_integral, Expanding the definition of extend, Using lemma binary_range_uchar, Using lemma max_uchar, Using lemma min_max_value_bits_uchar, Trying repeated skolemization, instantiation, and if-lifting, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uchar_range_values. Q.E.D.

C.198.29 Search_Example.search_terminates

Terse proof for search_terminates.
search_terminates:

{1} Valid(Search_Pre, search, λ (s: State): true)

Installing automatic rewrites from: valid Valid Search_Pre search Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax

er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr

2910

C.198 Proofs for Search_Example (search-example.pvs)

assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr

2911 C Proof scripts

comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point? Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v

cv_base_result_cv cv c v Installing automatic rewrites from: uchar_range_values Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_terminates. Q.E.D.

C.198.30 Search_Example.search_read_first

Terse proof for search_read_first.
search_read_first:

{1} valid(Search_Pre, search, read_first)

Installing automatic rewrites from: valid Valid Search_Pre search read_first search_terminates Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax

er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

2912

C.198 Proofs for Search_Example (search-example.pvs)

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point? Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v

cv_base_result_cv cv c v Installing automatic rewrites from: uchar_range_values Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2913 C Proof scripts

This completes the proof of search_read_first.

Q.E.D.

C.198.31 Search_Example.search_read_current

                                                                                                                 Terse proof for search_read_current.
                                                                                                                   search_read_current:

{1} valid(Search_Pre, search, read_current)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first search_terminates

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr

2914

C.198 Proofs for Search_Example (search-example.pvs)

break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr

continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr con-

tinue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_read_current.

Q.E.D.

C.198.32 Search_Example.search_deref_current

                                                                                                                        Terse proof for search_deref_current.
                                                                                                                        search_deref_current:

{1} valid(Search_Pre, search, deref_current)

Installing automatic rewrites from: valid Valid Search_Pre N search read_first deref_current search_read_current read_current search_terminates search_read_first

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

2915 C Proof scripts

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 address_add_zero address_add_sum same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr

2916

C.198 Proofs for Search_Example (search-example.pvs)

comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt

composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values Instantiating the top quantifier in -14 with the terms: (0), Instantiating the top quantifier in -15 with the terms: (0), Instantiating the top quantifier in -16 with the terms: (0), Instantiating the top quantifier in -17 with the terms: (0), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_deref_current. Q.E.D.

C.198.33 Search_Example.search_read_last

                                                                                                                        Terse proof for search_read_last.
                                                                                                                        search_read_last:

{1} valid(Search_Pre, search, read_last)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

2917 C Proof scripts

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr

2918

C.198 Proofs for Search_Example (search-example.pvs)

expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_read_last.

Q.E.D.

C.198.34 Search_Example.search_read_array

                                                                                                                        Terse proof for search_read_array.
                                                                                                                        search_read_array:

{1} valid(Search_Pre, search, read_array)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_read_last read_array search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

2919 C Proof scripts

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

2920

C.198 Proofs for Search_Example (search-example.pvs)

stantiation, skolemization, if-lifting and equality replacement, This completes the proof of search_read_array. Q.E.D.

C.198.35 Search_Example.search_not_found

Terse proof for search_not_found.
search_not_found:

{1} valid(Search_Pre, search, not_found)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_read_last read_array search_read_array not_found search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax

er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default

2921 C Proof scripts

return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point? Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v

cv_base_result_cv cv c v Installing automatic rewrites from: uchar_range_values Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement, This completes the proof of search_not_found. Q.E.D.

C.198.36 Search_Example.search_found

Terse proof for search_found.

search_found:

{1} valid(Search_Pre, search, found)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_read_last read_array

2922

C.198 Proofs for Search_Example (search-example.pvs)

search_read_array not_found search_not_found found search_terminates N Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax

er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok!

2923 C Proof scripts

stmt_while_inv_rewrite_data_break!  stmt_while_inv_rewrite_data_return!  pm_q_prop_while!

pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point? Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v

cv_base_result_cv cv c v Installing automatic rewrites from: uchar_range_values Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement, This completes the proof of search_found. Q.E.D.

C.199 Proofs for Segment_Reg_Datatype (paging-data.pvs)

C.199.1 Segment_Reg_Datatype.segment_selector_data_type_TCC1

Terse proof for segment_selector_data_type_TCC1.
segment_selector_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Segment_Selector_type])): true

Rewriting using segment_selector_type_exists, matching in *,

This completes the proof of segment_selector_data_type_TCC1.

Q.E.D.

C.199.2 Segment_Reg_Datatype.segment_reg_data_type_TCC1

Terse proof for segment_reg_data_type_TCC1.
segment_reg_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Segment_Reg_type])): true

2924

C.200 Proofs for Segment_Types (paging-data.pvs)

Using lemma segment_reg_data_type_exists,

This completes the proof of segment_reg_data_type_TCC1.

Q.E.D.

C.200 Proofs for Segment_Types (paging-data.pvs)

This theory contains no provable formal statements.

C.201 Proofs for SelectionStatements (statements.pvs)

This theory contains no provable formal statements.

C.202 Proofs for Set_Lift (vfiasco-prelude.pvs)

This theory contains no provable formal statements.

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.1 Single_Statement_Rewrites0.break_catch_break

Terse proof for break_catch_break.
break_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## break ## catch_break)(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of break_catch_break. Q.E.D.

C.203.2 Single_Statement_Rewrites0.break_break_stmt

Terse proof for break_break_stmt.
break_break_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_break)(s) = (stmt ## catch_break)(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of break_break_stmt. Q.E.D.

2925 C Proof scripts

C.203.3 Single_Statement_Rewrites0.break_break_catch_continue

Terse proof for break_break_catch_continue.
break_break_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## catch_continue ## catch_break)(s) = (stmt ## catch_break)(s)

,

This completes the proof of break_break_catch_continue.

Q.E.D.

C.203.4 Single_Statement_Rewrites0.break_break_catch_default

Terse proof for break_break_catch_default.
break_break_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## catch_default ## catch_break)(s) = (stmt ## catch_break)(s)

,

This completes the proof of break_break_catch_default.

Q.E.D.

C.203.5 Single_Statement_Rewrites0.break_break_lift_stmt

Terse proof for break_break_lift_stmt.
break_break_lift_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_break)(s) = (stmt ## catch_break)(s)

, This completes the proof of break_break_lift_stmt. Q.E.D.

C.203.6 Single_Statement_Rewrites0.break_break_case

Terse proof for break_break_case.
break_break_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## case(n) ## catch_break)(s) = (stmt ## catch_break)(s)

, This completes the proof of break_break_case. Q.E.D.

2926

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.7 Single_Statement_Rewrites0.break_break_default

Terse proof for break_break_default.
break_break_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## default ## catch_break)(s) = (stmt ## catch_break)(s)

, This completes the proof of break_break_default. Q.E.D.

C.203.8 Single_Statement_Rewrites0.break_break

Terse proof for break_break.

break_break:

{1} ∀ (s: State): Break?(break(s))

, This completes the proof of break_break. Q.E.D.

C.203.9 Single_Statement_Rewrites0.stmt_break_break

Terse proof for stmt_break_break.
stmt_break_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ Break?((stmt ## break)(s))

, This completes the proof of stmt_break_break. Q.E.D.

C.203.10 Single_Statement_Rewrites0.break_stmt_break

Terse proof for break_stmt_break.
break_stmt_break:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## stmt1)(s))

, This completes the proof of break_stmt_break. Q.E.D.

C.203.11 Single_Statement_Rewrites0.break_stmt_catch_continue

Terse proof for break_stmt_catch_continue.
break_stmt_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## catch_continue)(s))

2927 C Proof scripts

,

This completes the proof of break_stmt_catch_continue.

Q.E.D.

C.203.12 Single_Statement_Rewrites0.break_stmt_catch_default

Terse proof for break_stmt_catch_default.
break_stmt_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## catch_default)(s))

,

This completes the proof of break_stmt_catch_default.

Q.E.D.

C.203.13 Single_Statement_Rewrites0.break_stmt_lift

Terse proof for break_stmt_lift.
break_stmt_lift:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## lift(stmt1))(s))

, This completes the proof of break_stmt_lift. Q.E.D.

C.203.14 Single_Statement_Rewrites0.break_stmt_case

Terse proof for break_stmt_case.
break_stmt_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## case(n))(s))

, This completes the proof of break_stmt_case. Q.E.D.

C.203.15 Single_Statement_Rewrites0.break_stmt_default

Terse proof for break_stmt_default.
break_stmt_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## default)(s))

, This completes the proof of break_stmt_default. Q.E.D.

2928

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.16 Single_Statement_Rewrites0.continue_catch_continue

Terse proof for continue_catch_continue.
continue_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## continue ## catch_continue)(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of continue_catch_continue. Q.E.D.

C.203.17 Single_Statement_Rewrites0.continue_break_stmt

Terse proof for continue_break_stmt.
continue_break_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_continue)(s) = (stmt ## catch_continue)(s)

, This completes the proof of continue_break_stmt. Q.E.D.

C.203.18 Single_Statement_Rewrites0.continue_break_catch_continue

Terse proof for continue_break_catch_continue.
continue_break_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## catch_break ## catch_continue)(s) = (stmt ## catch_continue)(s)

,

This completes the proof of continue_break_catch_continue.

Q.E.D.

C.203.19 Single_Statement_Rewrites0.continue_break_catch_default

Terse proof for continue_break_catch_default.
continue_break_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## catch_default ## catch_continue)(s) = (stmt ## catch_continue)(s)

,

This completes the proof of continue_break_catch_default.

Q.E.D.

2929 C Proof scripts

C.203.20 Single_Statement_Rewrites0.continue_break_lift_stmt

Terse proof for continue_break_lift_stmt.
continue_break_lift_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_continue)(s) = (stmt ## catch_continue)(s)

,

This completes the proof of continue_break_lift_stmt.

Q.E.D.

C.203.21 Single_Statement_Rewrites0.continue_break_case

Terse proof for continue_break_case.
continue_break_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## case(n) ## catch_continue)(s) = (stmt ## catch_continue)(s)

, This completes the proof of continue_break_case. Q.E.D.

C.203.22 Single_Statement_Rewrites0.continue_break_default

Terse proof for continue_break_default.
continue_break_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## default ## catch_continue)(s) = (stmt ## catch_continue)(s)

, This completes the proof of continue_break_default. Q.E.D.

C.203.23 Single_Statement_Rewrites0.continue_continue

Terse proof for continue_continue.
continue_continue:

{1} ∀ (s: State): Continue?(continue(s))

, This completes the proof of continue_continue. Q.E.D.

C.203.24 Single_Statement_Rewrites0.stmt_continue_continue

Terse proof for stmt_continue_continue.

2930

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

stmt_continue_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ Continue?((stmt ## continue)(s))

, This completes the proof of stmt_continue_continue. Q.E.D.

C.203.25 Single_Statement_Rewrites0.continue_stmt_continue

Terse proof for continue_stmt_continue.
continue_stmt_continue:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## stmt1)(s))

, This completes the proof of continue_stmt_continue. Q.E.D.

C.203.26 Single_Statement_Rewrites0.continue_stmt_catch_break

Terse proof for continue_stmt_catch_break.
continue_stmt_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## catch_break)(s))

,

This completes the proof of continue_stmt_catch_break.

Q.E.D.

C.203.27 Single_Statement_Rewrites0.continue_stmt_catch_default

Terse proof for continue_stmt_catch_default.
continue_stmt_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## catch_default)(s))

,

This completes the proof of continue_stmt_catch_default.

Q.E.D.

C.203.28 Single_Statement_Rewrites0.continue_stmt_lift

Terse proof for continue_stmt_lift.
continue_stmt_lift:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## lift(stmt1))(s))

,

2931 C Proof scripts

This completes the proof of continue_stmt_lift. Q.E.D.

C.203.29 Single_Statement_Rewrites0.continue_stmt_case

Terse proof for continue_stmt_case.
continue_stmt_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## case(n))(s))

, This completes the proof of continue_stmt_case. Q.E.D.

C.203.30 Single_Statement_Rewrites0.continue_stmt_default

Terse proof for continue_stmt_default.
continue_stmt_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## default)(s))

, This completes the proof of continue_stmt_default. Q.E.D.

C.203.31 Single_Statement_Rewrites0.switch_stmt

Terse proof for switch_stmt.

switch_stmt:

{1} ∀ (n: int, stmt: [State → StmtResult[State]]):

switch_result(n) ## stmt = switch_result(n)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of switch_stmt. Q.E.D.

C.203.32 Single_Statement_Rewrites0.stmt_switch_stmt

Terse proof for stmt_switch_stmt.
stmt_switch_stmt:

{1} ∀ (n: int, stmt, stmt1: [State → StmtResult[State]]):

stmt ## switch_result(n) ## stmt1 = stmt ## switch_result(n)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, Trying repeated skolemization, instantiation, and if-lifting,

2932

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

This completes the proof of stmt_switch_stmt. Q.E.D.

C.203.33 Single_Statement_Rewrites0.switch_case_taken

Terse proof for switch_case_taken.
switch_case_taken:

{1} ∀ (n: int): (switch_result[State](n) ## case(n)) = skip

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of switch_case_taken. Q.E.D.

C.203.34 Single_Statement_Rewrites0.stmt_switch_case_taken

Terse proof for stmt_switch_case_taken.
stmt_switch_case_taken:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## case(n))(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of stmt_switch_case_taken. Q.E.D.

C.203.35 Single_Statement_Rewrites0.switch_case_not_taken

Terse proof for switch_case_not_taken.
switch_case_not_taken:

{1} ∀ (n_{1}, n_{2}: int): n_{1} ≠ n_{2} ⊃ switch_result[State](n_{1}) ## case(n_{2}) = switch_result(n_{1})

Expanding the definition of ##, Expanding the definition of case, Expanding the definition of switch_result, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_case_not_taken. Q.E.D.

C.203.36 Single_Statement_Rewrites0.stmt_switch_case_not_taken

Terse proof for stmt_switch_case_not_taken.

2933 C Proof scripts

                                                                                                                   stmt_switch_case_not_taken:

{1} ∀ (s: State, stmt: [State → StmtResult[State]], n_{1}, n_{2}: int):

OK?(stmt(s)) ∧ n_{1} ≠ n_{2} ⊃

(stmt ## switch_result(n_{1}) ## case(n_{2}))(s) = (stmt ## switch_result(n_{1}))(s)

,

                                                                                                                   This completes the proof of stmt_switch_case_not_taken.

Q.E.D.

C.203.37 Single_Statement_Rewrites0.switch_default

                                                                                                                 Terse proof for switch_default.
                                                                                                                   switch_default:

{1} ∀ (n: int): switch_result[State](n) ## default = switch_result(n)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of switch_default.

Q.E.D.

C.203.38 Single_Statement_Rewrites0.stmt_switch_default

                                                                                                                 Terse proof for stmt_switch_default.
                                                                                                                   stmt_switch_default:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## switch_result(n) ## default)(s) = (stmt ## switch_result(n))(s)

,

This completes the proof of stmt_switch_default.

Q.E.D.

C.203.39 Single_Statement_Rewrites0.switch_catch_break

                                                                                                                 Terse proof for switch_catch_break.
                                                                                                                   switch_catch_break:

{1} ∀ (n: int): switch_result[State](n) ## catch_break = switch_result(n)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of switch_catch_break.

Q.E.D.

2934

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.40 Single_Statement_Rewrites0.stmt_switch_catch_break

                                                                                                                        Terse proof for stmt_switch_catch_break.
                                                                                                                        stmt_switch_catch_break:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## catch_break)(s) = (stmt ## switch_result(n))(s)

,

This completes the proof of stmt_switch_catch_break.

Q.E.D.

C.203.41 Single_Statement_Rewrites0.switch_catch_continue

                                                                                                                        Terse proof for switch_catch_continue.
                                                                                                                        switch_catch_continue:

{1} ∀ (n: int): switch_result[State](n) ## catch_continue = switch_result(n)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_catch_continue. Q.E.D.

C.203.42 Single_Statement_Rewrites0.stmt_switch_catch_continue

                                                                                                                        Terse proof for stmt_switch_catch_continue.
                                                                                                                        stmt_switch_catch_continue:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## switch_result(n) ## catch_continue)(s) = (stmt ## switch_result(n))(s)

,

                                                                                                                        This completes the proof of stmt_switch_catch_continue.

Q.E.D.

C.203.43 Single_Statement_Rewrites0.switch_catch_default

                                                                                                                        Terse proof for switch_catch_default.
                                                                                                                        switch_catch_default:

{1} ∀ (n: int): switch_result[State](n) ## catch_default = switch_result(n)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of switch_catch_default.

Q.E.D.

2935 C Proof scripts

C.203.44 Single_Statement_Rewrites0.stmt_switch_catch_default

                                                                                                                        Terse proof for stmt_switch_catch_default.
                                                                                                                        stmt_switch_catch_default:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## catch_default)(s) = (stmt ## switch_result(n))(s)

,

                                                                                                                        This completes the proof of stmt_switch_catch_default.

Q.E.D.

C.203.45 Single_Statement_Rewrites0.default_stmt

Terse proof for default_stmt.

                                                                                                                        default_stmt:

{1} ∀ (stmt: [State → StmtResult[State]]): default_result ## stmt = default_result

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of default_stmt.

Q.E.D.

C.203.46 Single_Statement_Rewrites0.stmt_default_stmt

                                                                                                                        Terse proof for stmt_default_stmt.
                                                                                                                        stmt_default_stmt:

{1} ∀ (stmt, stmt1: [State → StmtResult[State]]):

stmt ## default_result ## stmt1 = stmt ## default_result

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_default_stmt.

Q.E.D.

C.203.47 Single_Statement_Rewrites0.default_case

Terse proof for default_case.

                                                                                                                        default_case:

{1} ∀ (n: int): default_result[State] ## case(n) = default_result

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of default_case.

Q.E.D.

2936

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.48 Single_Statement_Rewrites0.stmt_default_case

                                                                                                                        Terse proof for stmt_default_case.
                                                                                                                        stmt_default_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## default_result ## case(n))(s) = (stmt ## default_result)(s)

,

This completes the proof of stmt_default_case.

Q.E.D.

C.203.49 Single_Statement_Rewrites0.default_default

                                                                                                                        Terse proof for default_default.
                                                                                                                        default_default:

{1} default_result[State] ## default = skip

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of default_default.

Q.E.D.

C.203.50 Single_Statement_Rewrites0.stmt_default_default

                                                                                                                        Terse proof for stmt_default_default.
                                                                                                                        stmt_default_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## default_result ## default)(s) = stmt(s)

Repeatedly Skolemizing and flattening,

Trying repeated skolemization, instantiation, and if-lifting,

Applying extensionality,

This completes the proof of stmt_default_default.

Q.E.D.

C.203.51 Single_Statement_Rewrites0.default_catch_break

                                                                                                                        Terse proof for default_catch_break.
                                                                                                                        default_catch_break:

{1} default_result[State] ## catch_break = default_result

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of default_catch_break.

Q.E.D.

2937 C Proof scripts

C.203.52 Single_Statement_Rewrites0.stmt_default_catch_break

                                                                                                                        Terse proof for stmt_default_catch_break.
                                                                                                                        stmt_default_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## default_result ## catch_break)(s) = (stmt ## default_result)(s)

,

                                                                                                                        This completes the proof of stmt_default_catch_break.

Q.E.D.

C.203.53 Single_Statement_Rewrites0.default_catch_continue

                                                                                                                        Terse proof for default_catch_continue.
                                                                                                                        default_catch_continue:

{1} default_result[State] ## catch_continue = default_result

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_catch_continue. Q.E.D.

C.203.54 Single_Statement_Rewrites0.stmt_default_catch_continue

                                                                                                                        Terse proof for stmt_default_catch_continue.
                                                                                                                        stmt_default_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## default_result ## catch_continue)(s) = (stmt ## default_result)(s)

,

                                                                                                                        This completes the proof of stmt_default_catch_continue.

Q.E.D.

C.203.55 Single_Statement_Rewrites0.default_catch_default

                                                                                                                        Terse proof for default_catch_default.
                                                                                                                        default_catch_default:

{1} default_result[State] ## catch_default = skip

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_catch_default. Q.E.D.

2938

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.56 Single_Statement_Rewrites0.stmt_default_catch_default

                                                                                                                        Terse proof for stmt_default_catch_default.
                                                                                                                        stmt_default_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## default_result ## catch_default)(s) = stmt(s)

Repeatedly Skolemizing and flattening,

Trying repeated skolemization, instantiation, and if-lifting,

Applying extensionality,

                                                                                                                        This completes the proof of stmt_default_catch_default.

Q.E.D.

C.203.57 Single_Statement_Rewrites0.return_void_result

                                                                                                                        Terse proof for return_void_result.
                                                                                                                        return_void_result:

{1} return_void[State] = return_result

,

This completes the proof of return_void_result.

Q.E.D.

C.203.58 Single_Statement_Rewrites0.skip_ok

Terse proof for skip_ok.

                                                                                                                        skip_ok:

{1} ∀ (s: State): OK?(skip(s))

,

This completes the proof of skip_ok.

Q.E.D.

C.203.59 Single_Statement_Rewrites0.skip_state_TCC1

                                                                                                                        Terse proof for skip_state_TCC1.
                                                                                                                        skip_state_TCC1:

{1} ∀ (s: State):

OK?[State](skip[State](s)) ∨ Break?[State](skip[State](s)) ∨ Continue?[State](skip[State](s)) ∨ Return?[State](skip[State](s)) ∨ Switch?[State](skip[State](s)) ∨ Default?[State](skip[State](s)) ∨ Exception?[State](skip[State](s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of skip_state_TCC1.

Q.E.D.

2939 C Proof scripts

C.203.60 Single_Statement_Rewrites0.skip_state

Terse proof for skip_state.

                                                                                                                        skip_state:

{1} ∀ (s: State): state(skip(s)) = s

,

This completes the proof of skip_state.

Q.E.D.

C.203.61 Single_Statement_Rewrites0.skip_elemination

                                                                                                                        Terse proof for skip_elemination.
                                                                                                                        skip_elemination:

{1} ∀ (stmt: [State → StmtResult[State]]): (stmt ## skip) = stmt

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

Applying extensionality,

This completes the proof of skip_elemination.

Q.E.D.

C.203.62 Single_Statement_Rewrites0.stmt_skip_elemination

                                                                                                                        Terse proof for stmt_skip_elemination.
                                                                                                                        stmt_skip_elemination:

{1} ∀ (stmt: [State → StmtResult[State]]): (skip ## stmt) = stmt

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_skip_elemination. Q.E.D.

C.203.63 Single_Statement_Rewrites0.stmt_remove_catch_default

                                                                                                                        Terse proof for stmt_remove_catch_default.
                                                                                                                        stmt_remove_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## catch_default)(s) = stmt(s)

,

                                                                                                                        This completes the proof of stmt_remove_catch_default.

Q.E.D.

2940

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.64 Single_Statement_Rewrites0.stmt_remove_case

Terse proof for stmt_remove_case.
stmt_remove_case:

{1} ∀ (n: int, s: State, stmt1: [State → StmtResult[State]]):

OK?(stmt1(s)) ⊃ (stmt1 ## case(n))(s) = stmt1(s)

, This completes the proof of stmt_remove_case. Q.E.D.

C.203.65 Single_Statement_Rewrites0.stmt_remove_default

Terse proof for stmt_remove_default.
stmt_remove_default:

{1} ∀ (s: State, stmt1: [State → StmtResult[State]]):

OK?(stmt1(s)) ⊃ (stmt1 ## default)(s) = stmt1(s)

, This completes the proof of stmt_remove_default. Q.E.D.

C.203.66 Single_Statement_Rewrites0.stmt_remove_catch_continue

Terse proof for stmt_remove_catch_continue.
stmt_remove_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## catch_continue)(s) = stmt(s)

,

This completes the proof of stmt_remove_catch_continue.

Q.E.D.

C.203.67 Single_Statement_Rewrites0.stmt_remove_catch_break

Terse proof for stmt_remove_catch_break.
stmt_remove_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## catch_break)(s) = stmt(s)

, This completes the proof of stmt_remove_catch_break. Q.E.D.

C.203.68 Single_Statement_Rewrites0.stmt_ok_lift

Terse proof for stmt_ok_lift.

2941 C Proof scripts

stmt_ok_lift:

{1} ∀ (s: State, stmt1, stmt2: [State → StmtResult[State]]):

OK?(stmt1(s)) ⊃ (stmt1 ## lift(stmt2))(s) = (stmt1 ## stmt2)(s)

, This completes the proof of stmt_ok_lift. Q.E.D.

C.203.69 Single_Statement_Rewrites0.while_unroll_TCC1

Terse proof for while_unroll_TCC1.
while_unroll_TCC1:

{1} ∀ (max: nat): max > 0 ⊃ max − 1 ≥ 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_unroll_TCC1. Q.E.D.

C.203.70 Single_Statement_Rewrites0.while_unroll

Terse proof for while_unroll.

while_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], max: nat, s: State,

stmt: [State → StmtResult[State]]): max > 0 ⊃ while(max, b_ex, stmt)(s) = if_else(b_ex, stmt ## catch_continue ## while(max − 1, b_ex, stmt) ## catch_break,

skip) (s)

Repeatedly Skolemizing and flattening, Expanding the definition of while, Using lemma while_as_if_while, Simplifying, rewriting, and recording with decision procedures, This completes the proof of while_unroll. Q.E.D.

C.203.71 Single_Statement_Rewrites0.stmt_while_unroll

Terse proof for stmt_while_unroll.

2942

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

stmt_while_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], max: nat, s: State,

stmt1, stmt2: [State → StmtResult[State]]): max > 0 ⊃ (stmt1 ## while(max, b_ex, stmt2))(s) = (stmt1 ##

if_else(b_ex, stmt2 ## catch_continue ## while(max − 1, b_ex, stmt2) ## catch_break, skip))

(s)

Repeatedly Skolemizing and flattening,

Expanding the definition of ##,

Expanding the definition of lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using while_unroll, matching in *,

This completes the proof of stmt_while_unroll.

Q.E.D.

C.203.72 Single_Statement_Rewrites0.iterate_while_ok

Terse proof for iterate_while_ok.
iterate_while_ok:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]], n: nat): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(n, b_ex, stmt)(s_{1}))

Inducting on n on formula 1,

we get 2 subgoals:

iterate_while_ok.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]]): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(0, b_ex, stmt)(s_{1}))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of iterate_while_ok.1.

2943 C Proof scripts

iterate_while_ok.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]]): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(j, b_ex, stmt)(s_{1})))

⊃ (∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]]): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(j + 1, b_ex, stmt)(s_{1})))

Repeatedly Skolemizing and flattening, Expanding the definition of iterate_while, Instantiating quantified variables, Expanding the definition of ##, Expanding the definition of lift, Case splitting on OK?(catch_continue((e2s(b_ex!1) ## stmt!1)(s1!1))), we get 2 subgoals:

iterate_while_ok.2.1:

{-1} OK?(catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})))
{-2} j′ ≥ 0

{-3} ∀ (s_{1}: State):

(∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))) ⊃ OK?(iterate_while(j′, b_ex′, stmt′)(s_{1}))

{-4} ∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))

{1} OK?(cases catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) of OK(state): iterate_while(j′, b_ex′, stmt′)(state) else catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) endcases)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (state(catch_continue((e2s(b_ex!1) ##

stmt!1)(s1!1)))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of iterate_while_ok.2.1.

iterate_while_ok.2.2:

{-1} j′ ≥ 0

{-2} ∀ (s_{1}: State):

(∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))) ⊃ OK?(iterate_while(j′, b_ex′, stmt′)(s_{1}))

{-3} ∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))
{1} OK?(catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})))

{2} OK?(cases catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) of OK(state): iterate_while(j′, b_ex′, stmt′)(state) else catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) endcases)

Hiding formulas: 2, Expanding the definition of catch_continue, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

2944

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

This completes the proof of iterate_while_ok.2.2. Q.E.D.

C.203.73 Single_Statement_Rewrites0.while_hang

Terse proof for while_hang.

while_hang:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], stmt: [State → StmtResult[State]]): (∀ (s: State): OK?(b_ex(s)) ∧ data(b_ex(s)) ∧ OK?((e2s(b_ex) ## stmt)(s))) ⊃ while(b_ex, stmt) = hang_result

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of while, Expanding the definition of hang_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Expanding the definition of while_termination_point?, Hiding formulas: 1, Case splitting on OK?(iterate_while(n!1, b_ex!1, stmt!1)(x!1)), we get 2 subgoals:

while_hang.1:

{-1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))
{-2} n′ ≥ 0

{-3} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{-4} ∀ (s: State):

OK?(b_ex′(s)) ∧ data(b_ex′(s)) ∧ OK?((e2s(b_ex′) ## stmt′)(s))

Instantiating the top quantifier in -4 with the terms: (state(iterate_while(n!1, b_ex!1, stmt!1)(x!1))), we get 2 subgoals:

while_hang.1.1:

{-1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))
{-2} n′ ≥ 0

{-3} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{-4} OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∧ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∧ OK?((e2s(b_ex′) ## stmt′)(state(iterate_while(n′, b_ex′, stmt′)(x′))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_hang.1.1.

2945 C Proof scripts

while_hang.1.2:

{-1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))
{-2} n′ ≥ 0

{-3} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{1} OK?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Break?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Continue?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Return?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Switch?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Default?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Exception?[State](iterate_while[State](n′, b_ex′, stmt′)(x′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_hang.1.2.

while_hang.2:

{-1} n′ ≥ 0

{-2} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{-3} ∀ (s: State):

OK?(b_ex′(s)) ∧ data(b_ex′(s)) ∧ OK?((e2s(b_ex′) ## stmt′)(s))

{1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))

Rewriting using iterate_while_ok, matching in *, Keeping (-3 1) and hiding *, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_hang.2. Q.E.D.

C.203.74 Single_Statement_Rewrites0.composition_assoc_rewrite_stmt_ok

Terse proof for composition_assoc_rewrite_stmt_ok.
composition_assoc_rewrite_stmt_ok:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], s: State, stmt, stmt1: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## (stmt1 ## cstmt))(s) = ((stmt ## stmt1) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_stmt_ok.

Q.E.D.

2946

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

C.203.75 Single_Statement_Rewrites0.composition_assoc_rewrite_stmt_ok_cstmt

Terse proof for composition_assoc_rewrite_stmt_ok_cstmt.
composition_assoc_rewrite_stmt_ok_cstmt:

{1} ∀ (cstmt, cstmt1: [StmtResult[State] → StmtResult[State]], s: State,

stmt, stmt1: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ ((stmt ## (stmt1 ## cstmt)) ## cstmt1)(s) = (((stmt ## stmt1) ## cstmt) ## cstmt1)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_stmt_ok_cstmt.

Q.E.D.

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

C.204.1 Single_Statement_Rewrites1.forward_s_c_s_of_s_expr

Terse proof for forward_s_c_s_of_s_expr.
forward_s_c_s_of_s_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

(stmt ## cstmt)(s) = stmt(s) ⊃ (stmt ## cstmt ## expr)(s) = (stmt ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of forward_s_c_s_of_s_expr. Q.E.D.

C.204.2 Single_Statement_Rewrites1.stmt_ok_lift_expr

Terse proof for stmt_ok_lift_expr.
stmt_ok_lift_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt1, stmt2: [State → StmtResult[State]]): OK?(stmt1(s)) ⊃ (stmt1 ## lift(stmt2) ## expr)(s) = (stmt1 ## stmt2 ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_ok_lift_expr. Q.E.D.

C.204.3 Single_Statement_Rewrites1.break_break_stmt_expr

Terse proof for break_break_stmt_expr.

2947 C Proof scripts

break_break_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt, stmt1: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of break_break_stmt_expr. Q.E.D.

C.204.4 Single_Statement_Rewrites1.break_break_catch_continue_expr

Terse proof for break_break_catch_continue_expr.
break_break_catch_continue_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## catch_continue ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_catch_continue_expr.

Q.E.D.

C.204.5 Single_Statement_Rewrites1.break_break_catch_default_expr

Terse proof for break_break_catch_default_expr.
break_break_catch_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## catch_default ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_catch_default_expr.

Q.E.D.

C.204.6 Single_Statement_Rewrites1.break_break_lift_stmt_expr

Terse proof for break_break_lift_stmt_expr.
break_break_lift_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt, stmt1: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

2948

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_lift_stmt_expr.

Q.E.D.

C.204.7 Single_Statement_Rewrites1.break_break_case_expr

Terse proof for break_break_case_expr.
break_break_case_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], n: int, s: State,

stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## case(n) ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of break_break_case_expr. Q.E.D.

C.204.8 Single_Statement_Rewrites1.break_break_default_expr

Terse proof for break_break_default_expr.
break_break_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## default ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_default_expr.

Q.E.D.

C.204.9 Single_Statement_Rewrites1.continue_break_stmt_expr

Terse proof for continue_break_stmt_expr.
continue_break_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt, stmt1: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_stmt_expr.

Q.E.D.

C.204.10 Single_Statement_Rewrites1.continue_break_catch_continue_expr

Terse proof for continue_break_catch_continue_expr.

2949 C Proof scripts

continue_break_catch_continue_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## catch_break ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_catch_continue_expr.

Q.E.D.

C.204.11 Single_Statement_Rewrites1.continue_break_catch_default_expr

Terse proof for continue_break_catch_default_expr.
continue_break_catch_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## catch_default ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_catch_default_expr.

Q.E.D.

C.204.12 Single_Statement_Rewrites1.continue_break_lift_stmt_expr

Terse proof for continue_break_lift_stmt_expr.
continue_break_lift_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt, stmt1: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_lift_stmt_expr.

Q.E.D.

C.204.13 Single_Statement_Rewrites1.continue_break_case_expr

Terse proof for continue_break_case_expr.

2950

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

continue_break_case_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], n: int, s: State,

stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## case(n) ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_case_expr.

Q.E.D.

C.204.14 Single_Statement_Rewrites1.continue_break_default_expr

Terse proof for continue_break_default_expr.
continue_break_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## default ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_default_expr.

Q.E.D.

C.204.15 Single_Statement_Rewrites1.while_unroll_expr_TCC1

Terse proof for while_unroll_expr_TCC1.
while_unroll_expr_TCC1:

{1} ∀ (max: nat): max > 0 ⊃ max − 1 ≥ 0

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, This completes the proof of while_unroll_expr_TCC1. Q.E.D.

C.204.16 Single_Statement_Rewrites1.while_unroll_expr

Terse proof for while_unroll_expr.

2951 C Proof scripts

while_unroll_expr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], expr: [State → ExprRe-

sult[State, Data]],

max: nat, s: State, stmt: [State → StmtResult[State]]): max > 0 ⊃ (while(max, b_ex, stmt) ## expr)(s) = (if_else(b_ex, stmt ## catch_continue ## while(max − 1, b_ex, stmt) ## catch_break,

skip)

## expr) (s)

Repeatedly Skolemizing and flattening,

Expanding the definition of ##,

Rewriting using while_unroll, matching in *,

This completes the proof of while_unroll_expr.

Q.E.D.

C.204.17 Single_Statement_Rewrites1.while_unroll_lexpr

Terse proof for while_unroll_lexpr.
while_unroll_lexpr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], lexpr: [StmtResult[State] → ExprResult[State, Data]], max: nat, s: State, stmt: [State → StmtResult[State]]):

max > 0 ⊃ (while(max, b_ex, stmt) ## lexpr)(s) = (if_else(b_ex, stmt ## catch_continue ## while(max − 1, b_ex, stmt) ## catch_break,

skip)

## lexpr) (s)

Repeatedly Skolemizing and flattening,

Expanding the definition of ##,

Rewriting using while_unroll, matching in *,

This completes the proof of while_unroll_lexpr.

Q.E.D.

C.204.18 Single_Statement_Rewrites1.stmt_while_unroll_expr

Terse proof for stmt_while_unroll_expr.

2952

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

stmt_while_unroll_expr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], expr: [State → ExprRe-

sult[State, Data]],

max: nat, s: State, stmt1, stmt2: [State → StmtResult[State]]): max > 0 ⊃ (stmt1 ## while(max, b_ex, stmt2) ## expr)(s) = (stmt1 ##

if_else(b_ex, stmt2 ## catch_continue ## while(max − 1, b_ex, stmt2) ## catch_break, skip)

## expr) (s)

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of while, Using lemma while_as_if_while, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of stmt_while_unroll_expr. Q.E.D.

C.204.19 Single_Statement_Rewrites1.stmt_while_unroll_lexpr

Terse proof for stmt_while_unroll_lexpr.
stmt_while_unroll_lexpr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], lexpr: [StmtResult[State] → ExprResult[State, Data]], max: nat, s: State, stmt1, stmt2: [State → StmtResult[State]]):

max > 0 ⊃

(stmt1 ## while(max, b_ex, stmt2) ## lexpr)(s) =

(stmt1 ##

if_else(b_ex, stmt2 ## catch_continue ## while(max − 1, b_ex, stmt2) ## catch_break, skip)

## lexpr)

(s)

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of while, Using lemma while_as_if_while, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of stmt_while_unroll_lexpr. Q.E.D.

C.204.20 Single_Statement_Rewrites1.e2s_ok

Terse proof for e2s_ok.

2953 C Proof scripts

                                                                                                                   e2s_ok:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State):

OK?(expr(s)) ⊃ OK?(e2s(expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of e2s_ok.

Q.E.D.

C.204.21 Single_Statement_Rewrites1.stmt_e2s_ok

Terse proof for stmt_e2s_ok.

                                                                                                                   stmt_e2s_ok:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ OK?((stmt ## e2s(expr))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_e2s_ok.

Q.E.D.

C.204.22 Single_Statement_Rewrites1.e2s_state_TCC1

                                                                                                                 Terse proof for e2s_state_TCC1.
                                                                                                                   e2s_state_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State):

OK?(expr(s)) ⊃

OK?[State](e2s[State, Data](expr)(s)) ∨ Break?[State](e2s[State, Data](expr)(s)) ∨ Continue?[State](e2s[State, Data](expr)(s)) ∨ Return?[State](e2s[State, Data](expr)(s)) ∨ Switch?[State](e2s[State, Data](expr)(s)) ∨ Default?[State](e2s[State, Data](expr)(s)) ∨ Exception?[State](e2s[State, Data](expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of e2s_state_TCC1.

Q.E.D.

C.204.23 Single_Statement_Rewrites1.e2s_state_TCC2

                                                                                                                 Terse proof for e2s_state_TCC2.
                                                                                                                   e2s_state_TCC2:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State):

OK?(expr(s)) ⊃ OK?[State, Data](expr(s)) ∨ Exception?[State, Data](expr(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of e2s_state_TCC2.

2954

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

Q.E.D.

C.204.24 Single_Statement_Rewrites1.e2s_state

Terse proof for e2s_state.

                                                                                                                        e2s_state:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): OK?(expr(s)) ⊃ state(e2s(expr)(s)) = state(expr(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of e2s_state.

Q.E.D.

C.204.25 Single_Statement_Rewrites1.stmt_e2s_state_TCC1

                                                                                                                        Terse proof for stmt_e2s_state_TCC1.
                                                                                                                        stmt_e2s_state_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

OK?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Break?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Continue?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Return?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Switch?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Default?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Exception?[State]((##[State](stmt, e2s[State, Data](expr)))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_e2s_state_TCC1.

Q.E.D.

C.204.26 Single_Statement_Rewrites1.stmt_e2s_state_TCC2

                                                                                                                        Terse proof for stmt_e2s_state_TCC2.
                                                                                                                        stmt_e2s_state_TCC2:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

OK?[State, Data]((##[State, Data](stmt, expr))(s)) ∨

Exception?[State, Data]((##[State, Data](stmt, expr))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_e2s_state_TCC2.

Q.E.D.

2955 C Proof scripts

C.204.27 Single_Statement_Rewrites1.stmt_e2s_state

                                                                                                                        Terse proof for stmt_e2s_state.
                                                                                                                        stmt_e2s_state:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

state((stmt ## e2s(expr))(s)) = state((stmt ## expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_e2s_state.

Q.E.D.

C.204.28 Single_Statement_Rewrites1.comp_eval_if_ok_fstmt

                                                                                                                        Terse proof for comp_eval_if_ok_fstmt.
                                                                                                                        comp_eval_if_ok_fstmt:

{1} ∀ (expr: [State → ExprResult[State, Data]],

fstmt: [Data → [State → StmtResult[State]]], s: State): OK?(expr(s)) ⊃ (expr ## fstmt)(s) = (e2s(expr) ## fstmt(data(expr(s))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of comp_eval_if_ok_fstmt. Q.E.D.

C.204.29 Single_Statement_Rewrites1.stmt_eval_if_ok_fstmt

                                                                                                                        Terse proof for stmt_eval_if_ok_fstmt.
                                                                                                                        stmt_eval_if_ok_fstmt:

{1} ∀ (expr: [State → ExprResult[State, Data]], fstmt: [Data → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

(stmt ## (expr ## fstmt))(s) =

(stmt ## (e2s(expr) ## fstmt(data((stmt ## expr)(s)))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_eval_if_ok_fstmt. Q.E.D.

C.204.30 Single_Statement_Rewrites1.comp_eval_if_ok_fstmt_cstmt

                                                                                                                        Terse proof for comp_eval_if_ok_fstmt_cstmt.

2956

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

                                                                                                                        comp_eval_if_ok_fstmt_cstmt:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], fstmt: [Data → [State → StmtResult[State]]], s: State):

OK?(expr(s)) ⊃

((expr ## fstmt) ## cstmt)(s) =

(e2s(expr) ## fstmt(data(expr(s))) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of comp_eval_if_ok_fstmt_cstmt.

Q.E.D.

C.204.31 Single_Statement_Rewrites1.stmt_eval_if_ok_fstmt_cstmt

                                                                                                                        Terse proof for stmt_eval_if_ok_fstmt_cstmt.
                                                                                                                        stmt_eval_if_ok_fstmt_cstmt:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], fstmt: [Data → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

(stmt ## (expr ## fstmt) ## cstmt)(s) =

(stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of stmt_eval_if_ok_fstmt_cstmt.

Q.E.D.

C.204.32

Single_Statement_Rewrites1.composition_assoc_rewrite_expr_1

                                                                                                                        Terse proof for composition_assoc_rewrite_expr_1.
                                                                                                                        composition_assoc_rewrite_expr_1:

{1} ∀ (expr: [State → ExprResult[State, Data]], stmt, stmt1: [State → StmtRe-

sult[State]]): (stmt ## (stmt1 ## expr)) = ((stmt ## stmt1) ## expr)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of composition_assoc_rewrite_expr_1.

Q.E.D.

C.204.33

Single_Statement_Rewrites1.composition_assoc_rewrite_expr_2

                                                                                                                        Terse proof for composition_assoc_rewrite_expr_2.

2957 C Proof scripts

                                                                                                                        composition_assoc_rewrite_expr_2:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]],

expr: [State → ExprResult[State, Data]], stmt: [State → StmtResult[State]]):

(stmt ## (cstmt ## expr)) = ((stmt ## cstmt) ## expr)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of composition_assoc_rewrite_expr_2.

Q.E.D.

C.204.34

Single_Statement_Rewrites1.composition_assoc_rewrite_expr_3

                                                                                                                        Terse proof for composition_assoc_rewrite_expr_3.
                                                                                                                        composition_assoc_rewrite_expr_3:

{1} ∀ (cstmt, cstmt1: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]]):

(cstmt ## (cstmt1 ## expr)) = ((cstmt ## cstmt1) ## expr)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of composition_assoc_rewrite_expr_3.

Q.E.D.

C.204.35

Single_Statement_Rewrites1.composition_assoc_rewrite_expr_4

                                                                                                                        Terse proof for composition_assoc_rewrite_expr_4.
                                                                                                                        composition_assoc_rewrite_expr_4:

{1} ∀ (lexpr: [StmtResult[State] → ExprResult[State, Data]], stmt, stmt1: [State → StmtResult[State]]):

(stmt ## (lift(stmt1) ## lexpr)) = ((stmt ## stmt1) ## lexpr)

,

Applying decompose-equality,

                                                                                                                        This completes the proof of composition_assoc_rewrite_expr_4.

Q.E.D.

C.204.36

Single_Statement_Rewrites1.composition_assoc_rewrite_expr_5

                                                                                                                        Terse proof for composition_assoc_rewrite_expr_5.

2958

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

                                                                                                                        composition_assoc_rewrite_expr_5:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], lexpr: [StmtResult[State] → ExprResult[State, Data]], stmt: [State → StmtResult[State]]):

(stmt ## (cstmt ## lexpr)) = ((stmt ## cstmt) ## lexpr)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of composition_assoc_rewrite_expr_5.

Q.E.D.

C.204.37

Single_Statement_Rewrites1.composition_assoc_rewrite_expr_6

                                                                                                                        Terse proof for composition_assoc_rewrite_expr_6.
                                                                                                                        composition_assoc_rewrite_expr_6:

{1} ∀ (cstmt, cstmt1: [StmtResult[State] → StmtResult[State]],

lexpr: [StmtResult[State] → ExprResult[State, Data]]): (cstmt ## (cstmt1 ## lexpr)) = ((cstmt ## cstmt1) ## lexpr)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of composition_assoc_rewrite_expr_6.

Q.E.D.

C.204.38

Single_Statement_Rewrites1.composition_assoc_rewrite_stmt_ok

                                                                                                                        Terse proof for composition_assoc_rewrite_stmt_ok.
                                                                                                                        composition_assoc_rewrite_stmt_ok:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], s: State, stmt, stmt1: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## (stmt1 ## cstmt))(s) = ((stmt ## stmt1) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of composition_assoc_rewrite_stmt_ok.

Q.E.D.

C.204.39 Sin-

gle_Statement_Rewrites1.composition_assoc_rewrite_stmt_ok_expr

                                                                                                                        Terse proof for composition_assoc_rewrite_stmt_ok_expr.

2959 C Proof scripts

                                                                                                                        composition_assoc_rewrite_stmt_ok_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## (stmt1 ## cstmt) ## expr)(s) = ((stmt ## stmt1) ## cstmt ## expr)(s)

,

                                                                                                                        This completes the proof of composition_assoc_rewrite_stmt_ok_expr.

Q.E.D.

C.204.40 Sin-

gle_Statement_Rewrites1.composition_assoc_rewrite_stmt_ok_expr_lexpr

                                                                                                                        Terse proof for composition_assoc_rewrite_stmt_ok_expr_lexpr.
                                                                                                                        composition_assoc_rewrite_stmt_ok_expr_lexpr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], lexpr: [StmtResult[State] → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## (stmt1 ## cstmt) ## lexpr)(s) = ((stmt ## stmt1) ## cstmt ## lexpr)(s)

,

                                                                                                                        This completes the proof of composition_assoc_rewrite_stmt_ok_expr_lexpr.

Q.E.D.

C.204.41 Single_Statement_Rewrites1.ok_result_fstmt

                                                                                                                        Terse proof for ok_result_fstmt.
                                                                                                                        ok_result_fstmt:

{1} ∀ (fstmt: [Data → [State → StmtResult[State]]], data: Data):

ok_result(data) ## fstmt = fstmt(data)

Repeatedly Skolemizing and flattening,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ok_result_fstmt.

Q.E.D.

C.204.42 Single_Statement_Rewrites1.pm_q_prop_read_ok_s_read_ok

                                                                                                                        Terse proof for pm_q_prop_read_ok_s_read_ok.
                                                                                                                        pm_q_prop_read_ok_s_read_ok:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State): pm_q_prop_read(pm, dt, addr)(skip(s)) ⊃ OK?(read_data(pm, dt)(addr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

                                                                                                                        This completes the proof of pm_q_prop_read_ok_s_read_ok.

2960

C.205 Proofs for Single_Statement_Rewrites2 (statement-rewrites.pvs)

Q.E.D.

C.205 Proofs for Single_Statement_Rewrites2 (statement-rewrites.pvs)

C.205.1 Single_Statement_Rewrites2.ok_result_fexpr

Terse proof for ok_result_fexpr.
ok_result_fexpr:

{1} ∀ (fexpr: [Data2 → [State → ExprResult[State, Data1]]], data: Data2):

ok_result(data) ## fexpr = fexpr(data)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_fexpr. Q.E.D.

C.205.2 Single_Statement_Rewrites2.e2s_merge

Terse proof for e2s_merge.

e2s_merge:

{1} ∀ (expr: [State → ExprResult[State, Data1]],

expr1: [State → ExprResult[State, Data2]]): (e2s(expr) ## e2s(expr1)) = e2s(expr ## expr1)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of e2s_merge. Q.E.D.

C.205.3 Single_Statement_Rewrites2.stmt_e2s_merge

Terse proof for stmt_e2s_merge.
stmt_e2s_merge:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

stmt: [State → StmtResult[State]]): (stmt ## e2s(expr) ## e2s(expr1)) = (stmt ## e2s(expr ## expr1))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_e2s_merge. Q.E.D.

C Proof scripts

C.205.4 Single_Statement_Rewrites2.e2s_expr

Terse proof for e2s_expr.

e2s_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

s: State): (e2s(expr1) ## expr)(s) = (expr1 ## expr)(s)

, This completes the proof of e2s_expr. Q.E.D.

C.205.5 Single_Statement_Rewrites2.stmt_e2s_expr

Terse proof for stmt_e2s_expr.

stmt_e2s_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

s: State, stmt: [State → StmtResult[State]]): (stmt ## e2s(expr1) ## expr)(s) = (stmt ## expr1 ## expr)(s)

, This completes the proof of stmt_e2s_expr. Q.E.D.

C.205.6 Single_Statement_Rewrites2.composition_assoc_expression_rewrite_stmt

Terse proof for composition_assoc_expression_rewrite_stmt.
composition_assoc_expression_rewrite_stmt:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

stmt: [State → StmtResult[State]]): (stmt ## (expr ## expr1)) = ((stmt ## expr) ## expr1)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_expression_rewrite_stmt.

Q.E.D.

C.205.7 Single_Statement_Rewrites2.comp_eval_if_ok_fstmt_expr

Terse proof for comp_eval_if_ok_fstmt_expr.

2962

C.205 Proofs for Single_Statement_Rewrites2 (statement-rewrites.pvs)

comp_eval_if_ok_fstmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

fstmt: [Data1 → [State → StmtResult[State]]], s: State): OK?(expr(s)) ⊃ ((expr ## fstmt) ## expr1)(s) = (e2s(expr) ## fstmt(data(expr(s))) ## expr1)(s)

,

This completes the proof of comp_eval_if_ok_fstmt_expr.

Q.E.D.

C.205.8 Single_Statement_Rewrites2.stmt_eval_if_ok_fstmt_expr

Terse proof for stmt_eval_if_ok_fstmt_expr.
stmt_eval_if_ok_fstmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], fstmt: [Data1 → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fstmt) ## expr1)(s) = (stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## expr1)(s)

,

This completes the proof of stmt_eval_if_ok_fstmt_expr.

Q.E.D.

C.205.9 Single_Statement_Rewrites2.stmt_eval_if_ok_fexpr

Terse proof for stmt_eval_if_ok_fexpr.
stmt_eval_if_ok_fexpr:

{1} ∀ (expr1: [State → ExprResult[State, Data2]], fexpr: [Data2 → [State → ExprResult[State, Data1]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr1)(s)) ⊃ (stmt ## (expr1 ## fexpr))(s) = (stmt ## expr1 ## fexpr(data((stmt ## expr1)(s))))(s)

, This completes the proof of stmt_eval_if_ok_fexpr. Q.E.D.

C.205.10 Single_Statement_Rewrites2.comp_eval_if_ok_fstmt_cstmt_expr

Terse proof for comp_eval_if_ok_fstmt_cstmt_expr.

2963 C Proof scripts

comp_eval_if_ok_fstmt_cstmt_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]],

expr: [State → ExprResult[State, Data1]], expr1: [State → ExprResult[State, Data2]],

fstmt: [Data1 → [State → StmtResult[State]]], s: State): OK?(expr(s)) ⊃ (((expr ## fstmt) ## cstmt) ## expr1)(s) = (((e2s(expr) ## fstmt(data(expr(s)))) ## cstmt) ## expr1)(s)

,

This completes the proof of comp_eval_if_ok_fstmt_cstmt_expr.

Q.E.D.

C.205.11 Single_Statement_Rewrites2.stmt_eval_if_ok_fstmt_cstmt_expr

Terse proof for stmt_eval_if_ok_fstmt_cstmt_expr.
stmt_eval_if_ok_fstmt_cstmt_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe- sult[State, Data2]], fstmt: [Data1 → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]): OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fstmt) ## cstmt ## expr1)(s) = (stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## cstmt ## expr1)(s)

,

This completes the proof of stmt_eval_if_ok_fstmt_cstmt_expr.

Q.E.D.

C.206 Proofs for Single_Statement_Rewrites3 (statement-rewrites.pvs)

C.206.1 Single_Statement_Rewrites3.ok_result_elemination_2

Terse proof for ok_result_elemination_2.
ok_result_elemination_2:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

data: Data3): ((expr ## ok_result[State, Data3](data)) ## expr1) = (expr ## expr1)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_elemination_2.

2964

C.206 Proofs for Single_Statement_Rewrites3 (statement-rewrites.pvs)

Q.E.D.

C.206.2 Single_Statement_Rewrites3.comp_eval_if_ok_fexpr_expr

Terse proof for comp_eval_if_ok_fexpr_expr.
comp_eval_if_ok_fexpr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

fexpr: [Data1 → [State → ExprResult[State, Data3]]], s: State): OK?(expr(s)) ⊃ ((expr ## fexpr) ## expr1)(s) = (expr ## fexpr(data(expr(s))) ## expr1)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_eval_if_ok_fexpr_expr.

Q.E.D.

C.206.3 Single_Statement_Rewrites3.expr_eval_if_ok_fexpr

Terse proof for expr_eval_if_ok_fexpr.
expr_eval_if_ok_fexpr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

fexpr: [Data1 → [State → ExprResult[State, Data3]]], s: State): OK?((expr1 ## expr)(s)) ⊃ (expr1 ## (expr ## fexpr))(s) = (expr1 ## expr ## fexpr(data((expr1 ## expr)(s))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of expr_eval_if_ok_fexpr. Q.E.D.

C.206.4 Single_Statement_Rewrites3.composition_assoc_expression_rewrite

Terse proof for composition_assoc_expression_rewrite.
composition_assoc_expression_rewrite:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

expr2: [State → ExprResult[State, Data3]]): (expr ## (expr1 ## expr2)) = ((expr ## expr1) ## expr2)

Trying repeated skolemization, instantiation, and if-lifting, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_expression_rewrite.

Q.E.D.

2965 C Proof scripts

C.206.5 Single_Statement_Rewrites3.stmt_eval_if_ok_fexpr_expr

Terse proof for stmt_eval_if_ok_fexpr_expr.
stmt_eval_if_ok_fexpr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], fexpr: [Data1 → [State → ExprResult[State, Data3]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fexpr) ## expr1)(s) = (stmt ## expr ## fexpr(data((stmt ## expr)(s))) ## expr1)(s)

,

This completes the proof of stmt_eval_if_ok_fexpr_expr.

Q.E.D.

C.207 Proofs for Single_Statement_Rewrites4 (statement-rewrites.pvs)

C.207.1 Single_Statement_Rewrites4.expr_eval_if_ok_fexpr_expr

Terse proof for expr_eval_if_ok_fexpr_expr.
expr_eval_if_ok_fexpr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], expr2: [State → ExprResult[State, Data4]], fexpr: [Data2 → [State → ExprResult[State, Data3]]], s: State):

OK?((expr ## expr1)(s)) ⊃ (expr ## (expr1 ## fexpr) ## expr2)(s) = (expr ## expr1 ## fexpr(data((expr ## expr1)(s))) ## expr2)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_eval_if_ok_fexpr_expr.

Q.E.D.

C.208 Proofs for SkipStatements (statements.pvs)

This theory contains no provable formal statements.

C.209 Proofs for State_Transformer (state-transformer.pvs)

This theory contains no provable formal statements.

2966

C.210 Proofs for State_Transformer_Lift (state-transformer.pvs)

C.210 Proofs for State_Transformer_Lift (state-transformer.pvs)

This theory contains no provable formal statements.

C.211 Proofs for State_Transformer_Lift_Expr (state-transformer.pvs)

C.211.1 State_Transformer_Lift_Expr.ok_result_ok

Terse proof for ok_result_ok.

ok_result_ok:

{1} ∀ (s: State, data: Data): OK?(ok_result(data)(s))

, This completes the proof of ok_result_ok. Q.E.D.

C.211.2 State_Transformer_Lift_Expr.ok_result_data_TCC1

Terse proof for ok_result_data_TCC1.
ok_result_data_TCC1:

{1} ∀ (s: State, data: Data): OK?[State, Data](ok_result(data)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_data_TCC1. Q.E.D.

C.211.3 State_Transformer_Lift_Expr.ok_result_data

Terse proof for ok_result_data.
ok_result_data:

{1} ∀ (s: State, data: Data): data(ok_result(data)(s)) = data

, This completes the proof of ok_result_data. Q.E.D.

C.211.4 State_Transformer_Lift_Expr.ok_result_state

Terse proof for ok_result_state.
ok_result_state:

{1} ∀ (s: State, data: Data): state(ok_result(data)(s)) = s

, This completes the proof of ok_result_state. Q.E.D.

2967 C Proof scripts

C.211.5 State_Transformer_Lift_Expr.expr_2_super_ok_result

Terse proof for expr_2_super_ok_result.
expr_2_super_ok_result:

{1} ∀ (s: State, data: Data): OK?(expr_2_super(ok_result(data))(s))

, This completes the proof of expr_2_super_ok_result. Q.E.D.

C.211.6 State_Transformer_Lift_Expr.ok_lift_ok

Terse proof for ok_lift_ok.

ok_lift_ok:

{1} ∀ (s: State, d: lift[Data]): up?(d) ⊃ ok_lift(d)(s) = OK(s, down(d))

, This completes the proof of ok_lift_ok. Q.E.D.

C.211.7 State_Transformer_Lift_Expr.has_next_state_ok_result

Terse proof for has_next_state_ok_result.
has_next_state_ok_result:

{1} ∀ (s: State, data: Data): has_next_state(ok_result(data)(s))

,

This completes the proof of has_next_state_ok_result.

Q.E.D.

C.211.8 State_Transformer_Lift_Expr.has_next_state_fatal_result

Terse proof for has_next_state_fatal_result.
has_next_state_fatal_result:

{1} ∀ (s: State): ¬ has_next_state(fatal_result(s))

,

This completes the proof of has_next_state_fatal_result.

Q.E.D.

C.211.9 State_Transformer_Lift_Expr.expr_2_super_fatal_result

Terse proof for expr_2_super_fatal_result.
expr_2_super_fatal_result:

{1} ∀ (s: State): expr_2_super(fatal_result)(s) = Bottom

,

This completes the proof of expr_2_super_fatal_result.

Q.E.D.

2968

C.212 Proofs for State_Transformer_Lift_Stmt (state-transformer.pvs)

C.212 Proofs for State_Transformer_Lift_Stmt (state-transformer.pvs)

This theory contains no provable formal statements.

C.213 Proofs for Statement_Composition_Rewrites (state-transformer.pvs)

C.213.1 Statement_Composition_Rewrites.composition_assoc_rewrite_1

Terse proof for composition_assoc_rewrite_1.
composition_assoc_rewrite_1:

{1} ∀ (stmt_1, stmt_2, stmt_3: [State → StmtResult[State]]):

(stmt_1 ## (stmt_2 ## stmt_3)) = ((stmt_1 ## stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_1.

Q.E.D.

C.213.2 Statement_Composition_Rewrites.composition_assoc_rewrite_2

Terse proof for composition_assoc_rewrite_2.
composition_assoc_rewrite_2:

{1} ∀ (lift_stmt_3: [StmtResult[State] → StmtResult[State]],

stmt_1, stmt_2: [State → StmtResult[State]]): (stmt_1 ## (lift(stmt_2) ## lift_stmt_3)) = ((stmt_1 ## stmt_2) ## lift_stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_2.

Q.E.D.

C.213.3 Statement_Composition_Rewrites.composition_assoc_rewrite_3

Terse proof for composition_assoc_rewrite_3.
composition_assoc_rewrite_3:

{1} ∀ (lift_stmt_2: [StmtResult[State] → StmtResult[State]], stmt_1, stmt_3: [State → StmtResult[State]]): (stmt_1 ## (lift_stmt_2 ## stmt_3)) = ((stmt_1 ## lift_stmt_2) ## stmt_3)

2969 C Proof scripts

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_3.

Q.E.D.

C.213.4 Statement_Composition_Rewrites.composition_assoc_rewrite_4

Terse proof for composition_assoc_rewrite_4.
composition_assoc_rewrite_4:

{1} ∀ (lift_stmt_2, lift_stmt_3: [StmtResult[State] → StmtResult[State]],

stmt_1: [State → StmtResult[State]]): (stmt_1 ## (lift_stmt_2 ## lift_stmt_3)) = ((stmt_1 ## lift_stmt_2) ## lift_stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_4.

Q.E.D.

C.213.5 Statement_Composition_Rewrites.composition_assoc_rewrite_5

Terse proof for composition_assoc_rewrite_5.
composition_assoc_rewrite_5:

{1} ∀ (lift_stmt_1: [StmtResult[State] → StmtResult[State]], stmt_2, stmt_3: [State → StmtResult[State]]): (lift_stmt_1 ## (stmt_2 ## stmt_3)) = ((lift_stmt_1 ## stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_5.

Q.E.D.

C.213.6 Statement_Composition_Rewrites.composition_assoc_rewrite_6

Terse proof for composition_assoc_rewrite_6.
composition_assoc_rewrite_6:

{1} ∀ (lift_stmt_1, lift_stmt_3: [StmtResult[State] → StmtResult[State]],

stmt_2: [State → StmtResult[State]]): (equalities[[StmtResult[State] → StmtResult[State]]].=

((lift_stmt_1 ## (lift(stmt_2) ## lift_stmt_3)), ((lift_stmt_1 ## stmt_2) ## lift_stmt_3)))

2970

C.214 Proofs for Statement_Rewrites (statement-rewrites.pvs)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_6.

Q.E.D.

C.213.7 Statement_Composition_Rewrites.composition_assoc_rewrite_7

Terse proof for composition_assoc_rewrite_7.
composition_assoc_rewrite_7:

{1} ∀ (lift_stmt_1, lift_stmt_2: [StmtResult[State] → StmtResult[State]],

stmt_3: [State → StmtResult[State]]): (lift_stmt_1 ## (lift_stmt_2 ## stmt_3)) = ((lift_stmt_1 ## lift_stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_7.

Q.E.D.

C.213.8 Statement_Composition_Rewrites.composition_assoc_rewrite_8

Terse proof for composition_assoc_rewrite_8.
composition_assoc_rewrite_8:

{1} ∀ (lift_stmt_1, lift_stmt_2, lift_stmt_3: [StmtResult[State] → StmtResult[State]]): (equalities[[StmtResult[State] → StmtResult[State]]].= ((lift_stmt_1 ## (lift_stmt_2 ## lift_stmt_3)), ((lift_stmt_1 ## lift_stmt_2) ## lift_stmt_3)))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_8.

Q.E.D.

C.214 Proofs for Statement_Rewrites (statement-rewrites.pvs)

This theory contains no provable formal statements.

C.215 Proofs for Statements (statements.pvs)

This theory contains no provable formal statements.

2971 C Proof scripts

C.216 Proofs for StmtResult (result.pvs)

This theory contains no provable formal statements.

C.217 Proofs for StmtResult_adt (StmtResult_adt.pvs)

This theory contains no provable formal statements.

C.218 Proofs for StmtResult_adt_map (StmtResult_adt.pvs)

This theory contains no provable formal statements.

C.219 Proofs for StmtResult_adt_reduce (StmtResult_adt.pvs)

This theory contains no provable formal statements.

C.220 Proofs for Subtype_stable (graph.pvs)

C.220.1 Subtype_stable.length_stable

Terse proof for length_stable.

length_stable:

{1} ∀ (P: PRED[T ], l: list[T ]):

every(P)(l) ⊃ length[(P)](l) = length[T ](l)

By induction on l, and by repeatedly rewriting and simplifying, This completes the proof of length_stable. Q.E.D.

C.220.2 Subtype_stable.nth_stable_TCC1

Terse proof for nth_stable_TCC1.
nth_stable_TCC1:

{1} ∀ (P: PRED[T ], l: list[T ], n: below(length[T ](l))):

every(P)(l) ⊃ n < length[(P)](l)

Repeatedly Skolemizing and flattening, Rewriting using length_stable, matching in *, This completes the proof of nth_stable_TCC1. Q.E.D.

2972

C.220 Proofs for Subtype_stable (graph.pvs)

C.220.3 Subtype_stable.nth_stable

Terse proof for nth_stable.

nth_stable:

{1} ∀ (P: PRED[T ], l: list[T ], n: below(length(l))):
every(P)(l) ⊃ nth[(P)](l, n) = nth[T ](l, n)

Installing automatic rewrites from: length_stable Inducting on l on formula 1, we get 3 subgoals:

nth_stable.1:

{1} ∀ (P: PRED[T ], n: below(length(null))):

every(P)(null) ⊃ nth[(P)](null, n) = nth[T ](null, n)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_stable.1.

nth_stable.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P: PRED[T ], n: below(length(cons2_var))):

every(P)(cons2_var) ⊃ nth[(P)](cons2_var, n) = nth[T ](cons2_var, n)) ⊃ (∀ (P: PRED[T ], n: below(length(cons(cons1_var, cons2_var)))):

every(P)(cons(cons1_var, cons2_var)) ⊃ nth[(P)](cons(cons1_var, cons2_var), n) = nth[T ](cons(cons1_var, cons2_var), n))

Repeatedly Skolemizing and flattening, Expanding the definition of nth, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of every, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_stable.2.

nth_stable.3:

{1} ∀ (l: list[T ], P: PRED[T ], n: below(length[T ](l))):
every(P)(l) ⊃ n < length[(P)](l)
{2} ∀ (P: PRED[T ], n: below(length(l′))):